2024-05-24_27e1153f3971eac7957e39dd5d048f3d_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-24_27e1153f3971eac7957e39dd5d048f3d_mafia
Size

5.2MB
MD5

27e1153f3971eac7957e39dd5d048f3d
SHA1

eb771d48be949c109ad7a9360ec52413a46d7213
SHA256

8756bf22522e3f7b82b975636d352f4cc311150542d95f808f0eb0bd5a6c164a
SHA512

d2cf0dd3042149883d3d7c53f619024948e53eaa043fb8ff66783885e1b5752376edb1702924b31d16ddf9bb9cad9bc91e58eaa71304b81bd650dabeda5fe447
SSDEEP

98304:FkYInOLFB3OZ/OHu3mxSa6ewRaHpvvcwvhphz6skYsUI8YY5ACK0484U75yye2ca:FkYInNZ2RbwRx85nZVyy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_27e1153f3971eac7957e39dd5d048f3d_mafia

Files

2024-05-24_27e1153f3971eac7957e39dd5d048f3d_mafia
.exe windows:5 windows x86 arch:x86

dcd8b1090aff49a47be3d92d81c088ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
Sleep
GetProcAddress
FreeLibrary
WaitForSingleObject
GetExitCodeThread
CloseHandle
CreateThread
ExitThread
TlsFree
DeleteCriticalSection
TlsGetValue
TlsSetValue
LeaveCriticalSection
EnterCriticalSection
GetCurrentThread
SetThreadPriority
InitializeCriticalSection
TlsAlloc
IsBadWritePtr
WideCharToMultiByte
GetVersionExA
GetProcessHeap
SetEndOfFile
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
SleepEx
QueryPerformanceCounter
SwitchToThread
FormatMessageA
GetLastError
LocalFree
GetCurrentProcess
GetLongPathNameW
InterlockedIncrement
InterlockedDecrement
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryA
CreateDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetModuleHandleW
ExitProcess
MoveFileA
DeleteFileW
MoveFileW
RaiseException
RtlUnwind
GetCPInfo
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
SetLastError
GetCurrentThreadId
HeapSize
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
LoadLibraryW
GetTimeZoneInformation
CreateFileA
CreateFileW
ReadFile
SetFilePointer
GetUserDefaultLCID
GetLocaleInfoA
DeleteFileA

user32

GetForegroundWindow
DrawTextW
DrawTextA
GetCursor
ReleaseDC
GetClientRect
GetDC
GetWindowInfo
AdjustWindowRect
GetKeyboardLayout
GetCursorPos
MessageBoxA
PostQuitMessage
DefWindowProcW
ScreenToClient
IsIconic
SendMessageW
SetForegroundWindow
FindWindowW
DestroyWindow
UnregisterClassW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
SetCursor
DestroyIcon
GetWindowLongW
SystemParametersInfoW
ShowWindow
UpdateWindow
SetActiveWindow
SetWindowLongW
SetWindowPos

shell32

SHGetSpecialFolderPathA
SHGetFolderPathW
CommandLineToArgvW

jngload

?freeData@@YAXAAPAK@Z
?readMNG@@YAXPBXAAK1AAPAKK@Z

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod

shlwapi

PathFindFileNameW

psapi

GetModuleFileNameExW
EnumProcessModules

d3d8

Direct3DCreate8

dinput8

DirectInput8Create

ws2_32

recv
select
__WSAFDIsSet
send
connect
closesocket
WSAGetLastError
socket
setsockopt
htons
ioctlsocket
getsockopt
inet_addr

gdi32

GetDIBits
GetObjectA
CreateFontIndirectA
BitBlt
SetTextColor
SetBkColor
SetBkMode
CreateDIBSection
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontW
CreateSolidBrush
DeleteObject
DeleteDC

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dcd8b1090aff49a47be3d92d81c088ac

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

jngload

winmm

shlwapi

psapi

d3d8

dinput8

ws2_32

gdi32

advapi32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 30KB - Virtual size: 68KB

.rsrc Size: 387KB - Virtual size: 387KB

.reloc Size: 267KB - Virtual size: 266KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 30KB - Virtual size: 68KB

.rsrc
Size: 387KB - Virtual size: 387KB

.reloc
Size: 267KB - Virtual size: 266KB