2024-05-26_7e5652aa36a3bac3cfe3d8025e68c14e_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-26_7e5652aa36a3bac3cfe3d8025e68c14e_mafia
Size

10.8MB
MD5

7e5652aa36a3bac3cfe3d8025e68c14e
SHA1

9a7c8d4d37e7f7be08f8ca3608e21c61d5500789
SHA256

d055ab04ff59f7caad6995393c5bba58fd79ec4ff524209ea0d259ee19e2cc4e
SHA512

05d126f959abe8decb7266eb475be9794dbb196bd469003645e87340a215369d5ed28a1c9d34faf69f85399d5f5f64746c767319eddf452336e5eaef696e4969
SSDEEP

196608:Zc1wdRCLtoV8QMQITlZzwzigDSwlJOkL7fS6l0rjVUWJB6d+dPLPkqq9Hin643Sf:DMQIpqzJWwlJOMLSm0xJB6d+Jqg6kr8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-26_7e5652aa36a3bac3cfe3d8025e68c14e_mafia

Files

2024-05-26_7e5652aa36a3bac3cfe3d8025e68c14e_mafia
.exe windows:5 windows x86 arch:x86

55602b89b39629a376ad8171cad7227a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\svnwork\stormplayer\tags\5.35.0327.1111\Setup\BF_NewInstall\src\BF_InstallEngine\bin\Release\B5_Install.pdb

Imports

kernel32

CreateToolhelp32Snapshot
Process32FirstW
FindResourceExW
Process32NextW
OpenProcess
TerminateProcess
lstrcpynW
GetFileAttributesW
lstrcatW
lstrcmpiW
HeapAlloc
GetProcessHeap
GetModuleHandleA
HeapFree
MoveFileExW
Sleep
CopyFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
FlushInstructionCache
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
SetLastError
CreateMutexW
CreateFileMappingW
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
RaiseException
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
GlobalFree
TerminateThread
lstrcpyW
GetDiskFreeSpaceExW
OpenMutexW
LockResource
LoadResource
SizeofResource
FindResourceW
CreateProcessW
lstrlenA
CreateEventW
CreateSemaphoreW
ResetEvent
ReleaseSemaphore
InitializeCriticalSection
SetEvent
WaitForSingleObject
VirtualAlloc
VirtualFree
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
GlobalMemoryStatus
GetModuleHandleW
GetSystemInfo
FileTimeToSystemTime
SetEndOfFile
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
FindNextFileW
FindFirstFileW
FindClose
GetTempFileNameW
GetTempPathW
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
CreateFileA
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetStringTypeW
GetLocalTime
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FlushFileBuffers
GetConsoleCP
RtlUnwind
SetHandleCount
SearchPathW
GetCurrentDirectoryW
lstrlenW
GetFullPathNameW
DeleteFileW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
CreateFileW
GetSystemDirectoryW
GetWindowsDirectoryW
LocalFree
FormatMessageW
GetModuleFileNameW
LoadLibraryW
LoadLibraryExW
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
SetConsoleMode
GetConsoleMode
GetVersionExW
GetCommandLineW
SetFileApisToOEM
GetDriveTypeW
CompareFileTime
SetCurrentDirectoryW
GetProcAddress
FileTimeToLocalFileTime
GetCurrentProcess
GetProcessTimes
GetTickCount
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CloseHandle
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
WriteFile
GetStdHandle
HeapCreate
GetLocaleInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetSystemTimeAsFileTime
ExitProcess
VirtualQuery
VirtualProtect
CreateThread
ExitThread
EncodePointer
DecodePointer
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
GetLastError
HeapReAlloc
ReadFile
IsValidLocale
SetErrorMode
lstrcmpiA
GlobalReAlloc
GetVersion
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryA
GetVersionExA
HeapDestroy
DeleteCriticalSection

user32

InvalidateRect
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
GetParent
GetDesktopWindow
DestroyAcceleratorTable
ClientToScreen
CreateAcceleratorTableW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RedrawWindow
SetWindowPos
CharNextW
UnregisterClassA
MessageBoxA
GetProcessWindowStation
LoadCursorW
GetDC
TrackMouseEvent
EnableWindow
SetWindowRgn
PostQuitMessage
KillTimer
SetTimer
EqualRect
SetMenuItemInfoW
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
GetCursorPos
SetWindowsHookExW
SetPropA
SetClassLongW
GetClassLongW
RegisterClassExW
CallWindowProcW
GetWindowLongW
SetWindowLongW
DefWindowProcW
IsWindowEnabled
ReleaseDC
IsWindowVisible
UnhookWindowsHookEx
GetMenuItemInfoW
OffsetRect
CopyRect
InflateRect
SetWindowTextA
FindWindowA
GetWindowDC
GetMenuItemCount
SetParent
UpdateWindow
GetPropA
EndDialog
wsprintfW
SetForegroundWindow
CharUpperA
CharNextA
CharLowerW
CharUpperW
GetUserObjectInformationW
IsZoomed
GetWindowRect
LoadIconW
FindWindowExW
SendMessageTimeoutW
FindWindowW
WaitForInputIdle
MessageBoxW
EnableMenuItem
GetSystemMenu
PostMessageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
BeginPaint
EndPaint
IsChild
GetFocus
SetFocus
GetWindow
GetDlgItem
SendMessageW
IsWindow
GetClassNameW
GetSysColor
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SystemParametersInfoW
ShowWindow
SetRectEmpty
DrawTextW
MonitorFromWindow
GetMonitorInfoW
GetSystemMetrics
IsDialogMessageW
IsIconic
MapWindowPoints
GetWindowThreadProcessId
IsRectEmpty
SetRect
PtInRect
SetCursor
DrawIconEx
DialogBoxParamW

gdi32

DeleteDC
GetStockObject
DeleteObject
SetTextColor
SetBkColor
ExtTextOutW
CreatePen
CreateFontIndirectW
SetBkMode
GetClipBox
ExcludeClipRect
Rectangle
GetRgnBox
StretchBlt
GetPixel
CreateFontW
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
RealizePalette
GetDIBits
CreateDIBitmap
CreateDIBSection
ExtCreateRegion
CombineRgn
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetObjectW
CreateSolidBrush
GetDeviceCaps

advapi32

RegisterEventSourceA
RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
GetUserNameW
BuildExplicitAccessWithNameW
DeleteAce
GetExplicitEntriesFromAclW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegOpenKeyW
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetFileSecurityW
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ReportEventA
DeregisterEventSource
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CoUninitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CoCreateInstance
OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemRealloc
PropVariantClear

oleaut32

OleCreateFontIndirect
SysStringLen
VariantInit
SysStringByteLen
LoadRegTypeLi
VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
LoadTypeLi
SysAllocStringLen
SysFreeString
VarUI4FromStr

wininet

InternetGetConnectedState

sensapi

IsNetworkAlive

psapi

GetModuleFileNameExW

shlwapi

SHDeleteValueW
StrCmpW
PathAddBackslashW
PathRemoveFileSpecW
StrStrIW
StrChrIW
SHStrDupW
PathIsSameRootW
PathSkipRootW
SHDeleteKeyW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathStripToRootW
SHGetValueW
SHSetValueW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

TransparentBlt

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

winhttp

WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpConnect
WinHttpGetProxyForUrl
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winmm

timeKillEvent
timeSetEvent

iphlpapi

GetAdaptersInfo

gdiplus

GdipDisposeImage
GdipCloneImage
GdipFillRectangle
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipSetCompositingMode
GdipLoadImageFromStream
GdipReleaseDC
GdipFree
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipImageSelectActiveFrame
GdipDrawImageRectRect
GdipAlloc

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39.3MB - Virtual size: 39.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 187KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55602b89b39629a376ad8171cad7227a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

sensapi

psapi

shlwapi

comctl32

msimg32

wtsapi32

winhttp

version

winmm

iphlpapi

gdiplus

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 230KB - Virtual size: 230KB

.data Size: 61KB - Virtual size: 86KB

.rsrc Size: 39.3MB - Virtual size: 39.3MB

.reloc Size: 187KB - Virtual size: 187KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 230KB - Virtual size: 230KB

.data
Size: 61KB - Virtual size: 86KB

.rsrc
Size: 39.3MB - Virtual size: 39.3MB

.reloc
Size: 187KB - Virtual size: 187KB