2024-05-23_4e5b500fcca85fa659e063839aff8d9e_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-23_4e5b500fcca85fa659e063839aff8d9e_mafia
Size

3.2MB
MD5

4e5b500fcca85fa659e063839aff8d9e
SHA1

42802cfca067a91d1d791d97fe803f6f31ee7061
SHA256

fa9409b7f104f12a2533f997ccf96a188921d92d3e59c930d6422e1359b6740a
SHA512

343b9f9455f41dfbe4eb928ff72d6e5a3c087797364ef89bd59114556af655340b6c579a798dfd26b92c8d76c6f7b242e77ea2fe09f7630a358a872a53895f43
SSDEEP

49152:K1UPp/PLpp3rZOXdSVWSlhq9e/t1OXmQ6fMZnrLuoCf4NAj9eghvXC2cn9g6pPlj:fLHoNS1/Ce/t1OXmVfstW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_4e5b500fcca85fa659e063839aff8d9e_mafia

Files

2024-05-23_4e5b500fcca85fa659e063839aff8d9e_mafia
.exe windows:5 windows x86 arch:x86

c67acf9d420a97aabb519ebe413dfa8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Windforge\RetailSteam\Game\Bin\Game.pdb

Imports

kernel32

FindClose
FindNextFileW
FindFirstFileW
SetCurrentDirectoryW
GetModuleFileNameW
GetCommandLineW
GetSystemTimeAsFileTime
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
WaitForSingleObject
GetExitCodeProcess
CreatePipe
CreateFileA
GetFileAttributesA
CompareStringW
GetTimeZoneInformation
SetFilePointer
ReadFile
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
HeapCreate
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentDirectoryW
GetFullPathNameW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetLocaleInfoW
WriteFile
HeapSize
RaiseException
GetDateFormatA
GetTimeFormatA
MoveFileA
DuplicateHandle
CreateProcessA
ExitProcess
RtlUnwind
HeapReAlloc
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
SetConsoleCtrlHandler
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
PeekNamedPipe
GetFileInformationByHandle
DeleteFileA
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStdHandle
GetFileType
WriteConsoleW
FindFirstFileExW
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
DecodePointer
EncodePointer
LoadLibraryA
FormatMessageA
Sleep
GetModuleHandleW
QueryPerformanceCounter
QueryPerformanceFrequency
OutputDebugStringA
GetVersionExA
ReadProcessMemory
ResumeThread
GetThreadContext
SuspendThread
GetEnvironmentVariableA
GetModuleFileNameA
GetCurrentDirectoryA
SetLastError
GetLastError
GetEnvironmentVariableW
GetFileAttributesW
FreeLibrary
GetCurrentProcessId
GetCurrentProcess
GetProcAddress
GetCurrentThreadId
CreateFileW
LoadLibraryW
CloseHandle
GetCurrentThread
SetUnhandledExceptionFilter
WideCharToMultiByte

user32

EnumDisplaySettingsW
GetSystemMetrics
GetDC
ReleaseDC
DefWindowProcW
PostQuitMessage
DispatchMessageW
TranslateMessage
PeekMessageW
DestroyWindow
ChangeDisplaySettingsW
SetWindowPos
SetWindowLongW
ClipCursor
MapWindowPoints
GetClientRect
GetFocus
UpdateWindow
ShowWindow
CreateWindowExW
AdjustWindowRect
RegisterClassExW
LoadCursorW
SetCursor
LoadIconW
IsIconic

shell32

SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteW
CommandLineToArgvW

opengl32

glGetBooleanv
glClear
glReadBuffer
glDrawBuffer
glTexImage2D
glDeleteTextures
glTexParameteri
glBindTexture
glGenTextures
glTexCoord2f
glBlendFunc
glGetError
glViewport
wglDeleteContext
wglMakeCurrent
wglCreateContext
glTexEnvf
glFrontFace
glCullFace
glClearStencil
glClearDepth
glClearColor
glBegin
glEnd
glVertex2f
glDrawArrays
glEnable
glStencilFunc
glStencilOp
glColorMask
glDisable
glDepthMask
glDepthFunc

glew32

__glewDeleteFramebuffersEXT
__glewMapBufferRange
__glewDisableVertexAttribArray
__glewVertexAttribPointer
__glewUniform1f
__glewUniformMatrix4fv
__glewUniformMatrix3fv
__glewBlendEquation
__glewGetQueryObjectuivARB
__glewEndQueryARB
__glewBeginQueryARB
__glewDeleteQueriesARB
__glewGenQueriesARB
__glewUniform3fv
__glewDeleteBuffers
__glewUnmapBufferARB
__glewGenBuffers
__glewBindBuffer
__glewBufferData
__glewEnableVertexAttribArray
__glewGetUniformLocation
_glewInit@0
_glewIsSupported@4
__glewUseProgram
__glewCompressedTexImage2D
__glewGenerateMipmap
__GLEW_EXT_framebuffer_object
__glewBindFramebufferEXT
__glewGenFramebuffersEXT
__glewFramebufferTexture2DEXT
__glewGenRenderbuffersEXT
__glewBindRenderbufferEXT
__glewRenderbufferStorageEXT
__glewFramebufferRenderbufferEXT
__glewDrawBuffers
__glewCheckFramebufferStatusEXT
__glewMapBuffer
__glewDeleteRenderbuffersEXT
__glewUniform1i
__glewActiveTexture
__glewUniform2fv
__glewDetachShader
__glewDeleteShader
__glewDeleteProgram
__glewCreateShader
__glewShaderSource
__glewCompileShader
__glewGetShaderiv
__glewCreateProgram
__glewAttachShader
__glewLinkProgram
__glewGetProgramiv
__glewGetShaderInfoLog
__glewGetProgramInfoLog
__glewGetAttribLocation
__glewUniform4fv

winmm

timeGetTime

zlib1

deflate
deflateEnd
deflateInit_
inflateInit_
inflate
inflateEnd

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW

fmodstudio

?setCallback@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW44@W4FMOD_STUDIO_EVENT_CALLBACK_TYPE@@PAX@Z@Z
?start@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?release@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
??0?$Handle@VEventDescription@Studio@FMOD@@@Studio@FMOD@@IAE@XZ
??0?$Handle@VEventInstance@Studio@FMOD@@@Studio@FMOD@@IAE@XZ
?setVolume@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DAttributes@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_3D_ATTRIBUTES@@@Z
?getMixerStrip@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@W4FMOD_STUDIO_LOADING_MODE@@PAVMixerStrip@23@@Z
?setFaderLevel@MixerStrip@Studio@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
??0?$Handle@VMixerStrip@Studio@FMOD@@@Studio@FMOD@@IAE@XZ
?getFaderLevel@MixerStrip@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAM@Z
?setPaused@MixerStrip@Studio@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getSampleLoadingState@Bank@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_LOADING_STATE@@@Z
?loadSampleData@Bank@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createInstance@EventDescription@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAVEventInstance@23@@Z
?setListenerAttributes@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_3D_ATTRIBUTES@@@Z
?getEvent@System@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PBUFMOD_GUID@@W4FMOD_STUDIO_LOADING_MODE@@PAVEventDescription@23@@Z
?stop@EventInstance@Studio@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?isValid@?$Handle@VEventInstance@Studio@FMOD@@@Studio@FMOD@@QBG_NXZ
??0?$Handle@VBank@Studio@FMOD@@@Studio@FMOD@@IAE@ABV012@@Z
?setImpl@?$Handle@VBank@Studio@FMOD@@@Studio@FMOD@@IAGXPAVImpl@123@@Z
?setImpl@?$Handle@VMixerStrip@Studio@FMOD@@@Studio@FMOD@@IAGXPAVImpl@123@@Z
??0?$Handle@VBank@Studio@FMOD@@@Studio@FMOD@@IAE@XZ
?getPlaybackState@EventInstance@Studio@FMOD@@QBG?AW4FMOD_RESULT@@PAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?update@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?parseID@Studio@FMOD@@YG?AW4FMOD_RESULT@@PBDPAUFMOD_GUID@@@Z
??0?$Handle@VSystem@Studio@FMOD@@@Studio@FMOD@@IAE@XZ
?create@System@Studio@FMOD@@SG?AW4FMOD_RESULT@@PAV123@I@Z
?initialize@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@HIIPAX@Z
?release@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?loadBankFile@System@Studio@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAVBank@23@@Z
?setImpl@?$Handle@VSystem@Studio@FMOD@@@Studio@FMOD@@IAGXPAVImpl@123@@Z
?setImpl@?$Handle@VEventDescription@Studio@FMOD@@@Studio@FMOD@@IAGXPAVImpl@123@@Z
?setImpl@?$Handle@VEventInstance@Studio@FMOD@@@Studio@FMOD@@IAGXPAVImpl@123@@Z

metrics

?AddParam@SearchParameters@Metrics@@QAEXPB_W0@Z
?FindOrCreateProfile@MetricsManager@Metrics@@QAEPAVMetricsProfile@2@PB_WABUSearchParameters@2@@Z
?SetMetricValue@MetricsProfile@Metrics@@QAE_NPB_W_N@Z
?CreateProfile@MetricsManager@Metrics@@QAEPAVMetricsProfile@2@PB_W@Z
?SetMetricValue@MetricsProfile@Metrics@@QAE_NPB_W0@Z
?SetMetricValue@MetricsProfile@Metrics@@QAE_NPB_WN@Z
??1SearchParameters@Metrics@@QAE@XZ
??0SearchParameters@Metrics@@QAE@XZ
?FindOrCreateProfile@MetricsManager@Metrics@@QAEPAVMetricsProfile@2@PB_W00@Z
?IncrementMetricValue@MetricsProfile@Metrics@@QAE_NPB_WN@Z
?GetProfile@MetricsManager@Metrics@@QAEPAVMetricsProfile@2@PB_W@Z
?IsInitialized@MetricsManager@Metrics@@QBE_NXZ
?CloseGameSession@MetricsManager@Metrics@@QAEXXZ
?StartNewGameSession@MetricsManager@Metrics@@QAE_NH@Z
?IsLoggedIn@MetricsManager@Metrics@@QBE_NXZ
?Logout@MetricsManager@Metrics@@QAEXXZ
?ForceDeleteSavedProfiles@MetricsManager@Metrics@@QAEXXZ
?Commit@MetricsManager@Metrics@@QAE_NXZ
?Sync@MetricsManager@Metrics@@QAE_NXZ
?Login@MetricsManager@Metrics@@QAE_NPB_W0@Z
?Uninit@MetricsManager@Metrics@@QAEXXZ
?Init@MetricsManager@Metrics@@QAE_NPB_W@Z
??1MetricsManager@Metrics@@UAE@XZ
??0MetricsManager@Metrics@@QAE@XZ

gdi32

SetPixelFormat
ChoosePixelFormat
SwapBuffers

advapi32

GetUserNameA

glu32

gluErrorString

steam_api

SteamUserStats
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamAPI_Init
SteamUtils
SteamAPI_Shutdown
SteamAPI_RunCallbacks
SteamAPI_WriteMiniDump
SteamUser

xmllite

CreateXmlReader

shlwapi

ord12

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 503KB - Virtual size: 503KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c67acf9d420a97aabb519ebe413dfa8e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

opengl32

glew32

winmm

zlib1

version

fmodstudio

metrics

gdi32

advapi32

glu32

steam_api

xmllite

shlwapi

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 503KB - Virtual size: 503KB

.data Size: 52KB - Virtual size: 66KB

.rsrc Size: 240KB - Virtual size: 240KB

.reloc Size: 168KB - Virtual size: 167KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 503KB - Virtual size: 503KB

.data
Size: 52KB - Virtual size: 66KB

.rsrc
Size: 240KB - Virtual size: 240KB

.reloc
Size: 168KB - Virtual size: 167KB