2024-05-28_f71298704ca7c8bc2f207039a8878ce3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-28_f71298704ca7c8bc2f207039a8878ce3_mafia
Size

4.1MB
MD5

f71298704ca7c8bc2f207039a8878ce3
SHA1

ceb30e07d9457a624d95ae797b76729a8d202612
SHA256

abc27df66e865bfa3495f52f9f736d160019b14e99dff633cee34cd09408a269
SHA512

809e26cc01b30dc4158adbd330043491059b33469282863441e69c0a0f14234b13c8511ccdbe12543a6d40cea7953d87b70fb305a0308f0ea30f4f6b8c453722
SSDEEP

49152:mDpREqj5K9buN7X8zE0+bEyXJD7i98l2T/rTu9ayWicp1x+2:mLE79CNj8HLy5Xi96ayWnv+2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-28_f71298704ca7c8bc2f207039a8878ce3_mafia

Files

2024-05-28_f71298704ca7c8bc2f207039a8878ce3_mafia
.exe windows:5 windows x86 arch:x86

2b1cdacced339d963fdecb1d76ab7754

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\git_kcml\07.12.release.msc.x86.c\.debug\kclient.pdb

Imports

comctl32

ord16
CreateStatusWindowW
CreateToolbarEx
ImageList_AddMasked
ImageList_Create
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_DrawEx
ImageList_GetImageCount
ImageList_Merge
ImageList_Add
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_Draw
ImageList_GetIconSize
ImageList_DragShowNolock
PropertySheetW
ImageList_LoadImageW
ImageList_DragLeave
ImageList_EndDrag
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragMove
ord17
ImageList_DrawIndirect
ImageList_Remove
ImageList_GetIcon

oleaut32

SafeArrayPutElement
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SafeArrayDestroy
SafeArrayGetUBound
VariantCopy
SysStringByteLen
SysAllocStringLen
VariantCopyInd
LoadTypeLi
SafeArrayGetLBound
SafeArrayGetElement
VarUI4FromStr
VariantChangeType
LoadRegTypeLi
SysStringLen
SysAllocString
VariantClear
SysAllocStringByteLen
VariantInit
SafeArrayCreateVector

imm32

ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmGetOpenStatus
ImmSetConversionStatus
ImmSimulateHotKey

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

winmm

PlaySoundW
timeEndPeriod
timeKillEvent
timeSetEvent
timeBeginPeriod
timeGetDevCaps

kernel32

FindFirstChangeNotificationW
WaitForMultipleObjects
SetThreadPriority
GetCurrentThread
CreateDirectoryW
GetDriveTypeW
GetTempPathW
SetFileTime
SystemTimeToFileTime
GetSystemTime
SetCommState
GetCommState
SetCommTimeouts
GetFileInformationByHandle
InterlockedDecrement
GetTempFileNameW
GetCurrentDirectoryW
GetFileSizeEx
DeleteCriticalSection
InterlockedIncrement
GetUserDefaultLCID
IsDBCSLeadByteEx
GetCPInfo
lstrlenA
InitializeCriticalSectionAndSpinCount
FindAtomW
GetComputerNameW
RegisterWaitForSingleObject
OpenEventW
GetSystemTimeAsFileTime
FindCloseChangeNotification
ExitProcess
HeapDestroy
GetCPInfoExW
IsDebuggerPresent
DebugBreak
OutputDebugStringW
GetExitCodeProcess
VirtualQuery
GlobalHandle
GetVersion
GetSystemInfo
SetThreadAffinityMask
GetEnvironmentVariableW
GetTimeZoneInformation
SetEndOfFile
CreateNamedPipeW
GetFileTime
GetComputerNameA
GetTempFileNameA
DeviceIoControl
lstrcpyW
GetModuleFileNameW
FreeLibrary
FormatMessageW
SetStdHandle
SetEnvironmentVariableA
HeapCreate
FindNextChangeNotification
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
lstrlenW
WriteConsoleW
InterlockedCompareExchange
InterlockedPushEntrySList
GetStringTypeW
RtlUnwind
DecodePointer
EncodePointer
VirtualAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetFileType
CreateFileA
WideCharToMultiByte
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsValidCodePage
LCMapStringW
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
SetHandleCount
FlushFileBuffers
GetModuleFileNameA
QueryPerformanceCounter
InterlockedExchange
InitializeCriticalSection
ReleaseMutex
CreateMutexW
CompareFileTime
SetThreadLocale
MapViewOfFileEx
LocalReAlloc
GetPrivateProfileStringW
GetPrivateProfileIntW
SetEnvironmentVariableW
SetCurrentDirectoryW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
GetDiskFreeSpaceW
SetLastError
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetTimeFormatW
GetLocalTime
GetTickCount
GetFileSize
ReadProcessMemory
GlobalAddAtomW
GlobalDeleteAtom
GetLocaleInfoW
SetErrorMode
WriteFile
SetFilePointer
ReadFile
FindResourceExW
SizeofResource
UnmapViewOfFile
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
GlobalReAlloc
LocalAlloc
LocalLock
LocalUnlock
GetProfileStringW
CreateFileW
GetFileAttributesW
_lwrite
OpenFile
_llseek
_lclose
TlsFree
TlsAlloc
TlsGetValue
TlsSetValue
GetFullPathNameW
GetProcAddress
GetVersionExW
CreateProcessW
GetLastError
LocalFree
LoadLibraryExW
FindResourceW
LoadResource
LockResource
GlobalAlloc
GetModuleHandleW
GetOEMCP
GetACP
GetThreadLocale
GetCurrentThreadId
GetCommandLineW
DeleteFileW
CreateSemaphoreW
CloseHandle
CreateThread
ReleaseSemaphore
CreateEventW
GetSystemDirectoryA
LoadLibraryA
SetEvent
Sleep
ResetEvent
WaitForSingleObject
lstrcatW
GlobalFree
GlobalLock
VirtualFree
InterlockedPopEntrySList
MulDiv
GlobalUnlock
lstrcmpiW
WinExec
lstrcmpW
lstrcpynW
WaitNamedPipeW
LoadLibraryW

user32

DrawEdge
wsprintfA
GetCursor
GetKeyboardState
GetAsyncKeyState
SetWindowRgn
TrackPopupMenuEx
SetRectEmpty
CopyIcon
RegisterWindowMessageW
MapWindowPoints
MonitorFromWindow
IsMenu
IsCharAlphaNumericW
InsertMenuItemW
DestroyCursor
WindowFromDC
GetMenuItemID
IsDlgButtonChecked
CheckDlgButton
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DefFrameProcW
LoadStringW
GetScrollPos
DeleteMenu
EnumWindows
keybd_event
mouse_event
GetMenuItemRect
FindWindowExW
CharNextW
UpdateLayeredWindow
IsCharAlphaW
MonitorFromRect
LoadKeyboardLayoutW
DialogBoxParamW
DrawTextExW
GetPropW
GetWindowThreadProcessId
SubtractRect
CreatePopupMenu
ChildWindowFromPoint
SetMenuDefaultItem
GetKeyNameTextW
LoadImageW
GetCursorPos
OffsetRect
IsRectEmpty
MapDialogRect
GetSysColorBrush
DrawStateW
GetMessagePos
PtInRect
GetMenuItemCount
TrackPopupMenu
SetParent
SetMenuItemInfoW
DrawMenuBar
UnregisterClassW
SetMenu
CreateMDIWindowW
ChildWindowFromPointEx
GetMessageTime
SetActiveWindow
GetMenuBarInfo
ScreenToClient
RedrawWindow
DrawIconEx
GetActiveWindow
GetWindowDC
ClientToScreen
RemoveMenu
GetWindow
GetDlgCtrlID
DefMDIChildProcW
GetForegroundWindow
MsgWaitForMultipleObjects
BringWindowToTop
SetForegroundWindow
GetScrollInfo
CallWindowProcW
DdeEnableCallback
DdeGetData
GetDesktopWindow
DefDlgProcW
RegisterClipboardFormatW
LoadMenuW
DdeConnect
DdeInitializeW
DdeCreateDataHandle
DdeQueryStringW
DdeNameService
DdeGetLastError
DdeUninitialize
DdeDisconnect
DdeAccessData
DdeUnaccessData
DdeCreateStringHandleW
DdeFreeStringHandle
DdeClientTransaction
PeekMessageW
TabbedTextOutW
SetCursor
ShowCursor
DestroyCaret
EnumChildWindows
ScrollWindowEx
CreateCaret
IntersectRect
InvertRect
EqualRect
GetClipboardData
GetClassLongW
MoveWindow
CheckRadioButton
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
EnableWindow
SetClipboardViewer
GetClassNameW
FindWindowW
RegisterClassExW
AdjustWindowRectEx
DestroyIcon
CreateMenu
CreateWindowExW
GetMenuItemInfoW
VkKeyScanW
LoadCursorW
RegisterClassW
FillRect
InflateRect
FrameRect
DrawFrameControl
DrawTextW
DrawFocusRect
SetCapture
ReleaseCapture
GetSubMenu
ShowCaret
IsWindowVisible
ShowWindow
GetSystemMenu
SetCaretPos
GetMessageW
IsWindowEnabled
TranslateMessage
IsDialogMessageW
DispatchMessageW
SystemParametersInfoW
HideCaret
NotifyWinEvent
GetKeyState
MapVirtualKeyW
SetScrollRange
SetScrollPos
ShowScrollBar
SetWindowPlacement
GetKeyboardLayout
DrawIcon
ChangeClipboardChain
DestroyMenu
PostQuitMessage
WinHelpW
DestroyWindow
GetMenu
IsClipboardFormatAvailable
EnableMenuItem
CheckMenuItem
PostThreadMessageW
SendNotifyMessageW
EndDialog
GetDlgItem
GetWindowTextLengthW
SetFocus
GetWindowTextW
LoadIconW
GetFocus
MessageBeep
PostMessageW
KillTimer
SetTimer
GetWindowRect
GetParent
GetWindowPlacement
UpdateWindow
BeginPaint
GetClientRect
EndPaint
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetWindowLongW
DefWindowProcW
SetWindowPos
GetWindowLongW
SetRect
AdjustWindowRect
GetSystemMetrics
IsIconic
IsZoomed
CopyRect
wsprintfW
GetMenuState
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
LoadBitmapW
SetScrollInfo
GetClassInfoExW
UnionRect
MonitorFromPoint
GetMonitorInfoW
GetClassInfoW
GetCapture
TrackMouseEvent
CreateIconFromResourceEx
GetIconInfo
CreateIconIndirect
InvalidateRect
WindowFromPoint
GetDoubleClickTime
SetPropW
GetSysColor
GetDC
ReleaseDC
DialogBoxIndirectParamW
CreateDialogIndirectParamW
InsertMenuW
IsWindow
RemovePropW
AppendMenuW
SendMessageW
SendDlgItemMessageW
SetDlgItemTextW
MessageBoxW
SetWindowTextW
SendInput
SetClassLongW
UnregisterClassA

advapi32

CryptReleaseContext
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
GetUserNameW
RegQueryInfoKeyW
GetLengthSid
GetTokenInformation
OpenProcessToken
SetSecurityInfo
GetAce
GetSecurityDescriptorDacl
RegGetKeySecurity
InitializeAcl
RegOpenKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
LookupAccountNameW
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
AddAccessDeniedAce
AddAccessAllowedAce
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegOpenCurrentUser
RegSetValueExA
CryptDestroyKey
RegQueryValueExW

gdi32

Polyline
SetDIBitsToDevice
ExtCreatePen
RoundRect
LineTo
GetNearestColor
ExtSelectClipRgn
GetObjectW
GetStockObject
GetTextMetricsW
GetTextFaceW
SelectObject
StretchDIBits
SetStretchBltMode
RealizePalette
SelectPalette
SetBkMode
DeleteObject
UnrealizeObject
CreateFontIndirectW
SetTextColor
SetBkColor
Rectangle
CreateSolidBrush
ExtTextOutW
RemoveFontResourceW
AddFontResourceW
GetDeviceCaps
EndDoc
EndPage
TextOutW
MoveToEx
SetTextAlign
StartPage
StartDocW
GetDIBits
AbortDoc
GetTextExtentPointW
SetAbortProc
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
GetCurrentPositionEx
GetTextExtentPoint32W
CreateDCW
GetCurrentObject
CreatePen
PatBlt
BitBlt
ExcludeClipRect
Polygon
CreateDIBSection
GdiFlush
CreatePalette
GetPixel
SetDIBits
GetNearestPaletteIndex
StretchBlt
SetBrushOrgEx
GetBrushOrgEx
SetMetaFileBitsEx
DeleteMetaFile
GetSystemPaletteEntries
SelectClipRgn
CreateRectRgn
SetViewportOrgEx
RestoreDC
PlayMetaFile
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC
CombineRgn
GetClipRgn
GetViewportOrgEx
GetTextColor
GetCharWidthW
GetBkColor
GetCharWidth32W
EnumFontFamiliesW
CreateICW
TranslateCharsetInfo
Ellipse
GetObjectA
OffsetRgn
CreateRectRgnIndirect
FillRgn

ws2_32

gethostbyaddr
ioctlsocket
WSAEventSelect
shutdown
select
WSAGetLastError
ntohs
WSASetLastError
closesocket
connect
socket
setsockopt
getsockname
getpeername
WSAResetEvent
WSAWaitForMultipleEvents
WSACreateEvent
WSAStartup
ntohl
gethostname
getsockopt
accept
bind
listen
WSAEnumNetworkEvents
inet_ntoa
gethostbyname
inet_addr
htonl
getservbyname
WSACleanup
htons
send
recv
getservbyport

shell32

SHFileOperationW
ShellExecuteA
SHGetSpecialFolderLocation
CommandLineToArgvW
SHGetFileInfoW
ExtractIconW
ExtractIconExW
DuplicateIcon
SHChangeNotify
Shell_NotifyIconW
DragAcceptFiles
SHGetSpecialFolderPathW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
DragQueryPoint
DragFinish
ShellExecuteW

winspool.drv

StartDocPrinterW
ClosePrinter
EndDocPrinter
EndPagePrinter
OpenPrinterW
DocumentPropertiesW
GetPrinterW
WritePrinter
StartPagePrinter

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW
ChooseFontW
PageSetupDlgW
PrintDlgW
ChooseColorW

ole32

CoTaskMemAlloc
ReleaseStgMedium
StgCreateStorageEx
RegisterDragDrop
CoTaskMemFree
StringFromCLSID
CoTaskMemRealloc
DoDragDrop
CLSIDFromProgID
CoSetProxyBlanket
CoInitializeSecurity
StringFromIID
CreateBindCtx
CoCreateGuid
CoCreateInstance
RevokeDragDrop
CoGetClassObject
StgCreateDocfile
CreateStreamOnHGlobal
CLSIDFromString
CoUninitialize
OleUninitialize
OleInitialize
CoInitializeEx
MkParseDisplayName

gdiplus

GdipSetSmoothingMode
GdipTranslateWorldTransform
GdipDrawLineI
GdipDrawPath
GdipCombineRegionRectI
GdipCloneRegion
GdipDrawLinesI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatHotkeyPrefix
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCreatePen1
GdipGetImageBounds
GdipCreateBitmapFromHICON
GdipCloneBrush
GdipSetStringFormatAlign
GdipDrawImageI
GdipCloneImage
GdipSetLineBlend
GdipLoadImageFromFile
GdipCreateTexture
GdipCreateLineBrushFromRectWithAngleI
GdipClosePathFigure
GdipAddPathLineI
GdipSetStringFormatFlags
GdipGetSmoothingMode
GdipDrawArcI
GdipFillPath
GdiplusShutdown
GdiplusStartup
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipRestoreGraphics
GdipSaveGraphics
GdipSetClipRegion
GdipSetClipRectI
GdipGetPenWidth
GdipCreateSolidFill
GdipDeletePen
GdipCreatePen2
GdipDeleteBrush
GdipAlloc
GdipCreateRegion
GdipGetClip
GdipFillRectangleI
GdipGetWorldTransform
GdipReleaseDC
GdipGetDC
GdipCreateFromHWND
GdipCreateFromHDC
GdipGetMatrixElements
GdipCreateMatrix
GdipFree
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipDeleteRegion
GdipDeleteGraphics
GdipDeletePath
GdipCreatePath
GdipDeleteMatrix
GdipDisposeImage
GdipAddPathArcI

secur32

GetUserNameExW

iphlpapi

NotifyAddrChange

oleacc

AccessibleObjectFromWindow
LresultFromObject

msimg32

GradientFill

Exports

Exports

_KClient@16
_KClientLoadError@16
_KClientSnoop@8
_RegisterAboutControl@8
_RegisterOurDlgControl@8
_SetInternal@0

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

K_BSS
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 851KB - Virtual size: 851KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

K_DATA
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_text
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 816KB - Virtual size: 815KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b1cdacced339d963fdecb1d76ab7754

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

oleaut32

imm32

version

winmm

kernel32

user32

advapi32

gdi32

ws2_32

shell32

winspool.drv

comdlg32

ole32

gdiplus

secur32

iphlpapi

oleacc

msimg32

Exports

Exports

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

K_BSS Size: - Virtual size: 58KB

.rdata Size: 851KB - Virtual size: 851KB

.data Size: 35KB - Virtual size: 43KB

K_DATA Size: 25KB - Virtual size: 25KB

_text Size: 512B - Virtual size: 1B

.rsrc Size: 816KB - Virtual size: 815KB

.reloc Size: 199KB - Virtual size: 198KB

.text
Size: 2.2MB - Virtual size: 2.2MB

K_BSS
Size: - Virtual size: 58KB

.rdata
Size: 851KB - Virtual size: 851KB

.data
Size: 35KB - Virtual size: 43KB

K_DATA
Size: 25KB - Virtual size: 25KB

_text
Size: 512B - Virtual size: 1B

.rsrc
Size: 816KB - Virtual size: 815KB

.reloc
Size: 199KB - Virtual size: 198KB