2024-06-01_b1a3c2119f3908e3bb662e75c5af6f90_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-01_b1a3c2119f3908e3bb662e75c5af6f90_mafia
Size

4.2MB
MD5

b1a3c2119f3908e3bb662e75c5af6f90
SHA1

94ebbb2a833c7a166ce01592da1fe7da4df73515
SHA256

eecdca7d45e329019742204aee7809b9a82793ce64176b36fc2a812b6560e276
SHA512

28157d2fc05c01a6b6a0c3a7003a3ba3f63503a546a98ce7deeefe7e8f662c2274d29810a2735e2bc14f46b3a8e784838297d283be5878e86a5575cc59d707ee
SSDEEP

49152:bNdVqeko9U0jHPMmQifPxQykHC86WaC+gsVI/hv5ufTguDTya8cRVbt:hdVWJmU9ifPxQykiZ7gEmS9Tya5Vbt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-01_b1a3c2119f3908e3bb662e75c5af6f90_mafia

Files

2024-06-01_b1a3c2119f3908e3bb662e75c5af6f90_mafia
.exe windows:5 windows x86 arch:x86

ba7638ef0ae3030b71c1b95892ca5e7e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\git_kcml\07.15.release.msc.x86.c\.debug\kclient.pdb

Imports

comctl32

ImageList_DrawEx
ImageList_GetImageCount
ImageList_Merge
ImageList_Add
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_Draw
ImageList_GetIconSize
ImageList_DragShowNolock
ord16
ImageList_LoadImageW
ImageList_DragLeave
ImageList_EndDrag
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragMove
ord17
ImageList_DrawIndirect
ImageList_Remove
ImageList_GetIcon
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_Create
ImageList_AddMasked
CreateToolbarEx
CreateStatusWindowW
PropertySheetW

oleaut32

SysFreeString
VariantClear
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantCopyInd
SysAllocStringLen
SysStringByteLen
VariantCopy
VariantChangeType
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VarUI4FromStr
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayCreate
VariantInit
SysAllocStringByteLen

imm32

ImmNotifyIME
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmGetOpenStatus
ImmSimulateHotKey
ImmSetConversionStatus

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winmm

timeEndPeriod
timeKillEvent
timeSetEvent
timeBeginPeriod
timeGetDevCaps
PlaySoundW

kernel32

InterlockedDecrement
GetTempFileNameW
GetCurrentDirectoryW
FindAtomW
GetFileSizeEx
DeleteCriticalSection
InterlockedIncrement
lstrlenA
GetUserDefaultLCID
IsDBCSLeadByteEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetComputerNameW
RegisterWaitForSingleObject
OpenEventW
GetSystemTimeAsFileTime
HeapCreate
ExitProcess
HeapDestroy
GetCPInfoExW
IsDebuggerPresent
GetFileInformationByHandle
OutputDebugStringW
GetExitCodeProcess
VirtualQuery
GlobalHandle
GetVersion
GetSystemInfo
SetThreadAffinityMask
GetEnvironmentVariableW
GetTimeZoneInformation
SetEndOfFile
GetLocaleInfoA
WaitNamedPipeW
GetComputerNameA
GetTempFileNameA
DeviceIoControl
GetCommState
SetCommState
DebugBreak
SetCommTimeouts
GetSystemTime
SystemTimeToFileTime
SetFileTime
GetTempPathW
GetDriveTypeW
CreateDirectoryW
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
FindFirstChangeNotificationW
FindCloseChangeNotification
FindNextChangeNotification
GetFileTime
InitializeCriticalSection
CompareFileTime
SetThreadLocale
MapViewOfFileEx
LocalReAlloc
GetPrivateProfileStringW
GetPrivateProfileIntW
SetEnvironmentVariableW
SetCurrentDirectoryW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
CreateNamedPipeW
FindClose
GetDiskFreeSpaceW
SetLastError
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
WriteConsoleW
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetTimeFormatW
GetLocalTime
GetTickCount
GetFileSize
ReadProcessMemory
GlobalAddAtomW
GlobalDeleteAtom
GetLocaleInfoW
SetErrorMode
WriteFile
RtlUnwind
GetStringTypeW
DecodePointer
EncodePointer
GetTimeFormatA
GetDateFormatA
VirtualAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetFileType
CreateFileA
WideCharToMultiByte
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsValidCodePage
LCMapStringW
MultiByteToWideChar
GetConsoleCP
GetConsoleMode
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSize
SetHandleCount
FlushFileBuffers
GetModuleFileNameA
QueryPerformanceCounter
InterlockedExchange
SetFilePointer
ReadFile
FindResourceExW
SizeofResource
UnmapViewOfFile
GetCurrentProcessId
CreateFileMappingW
MapViewOfFile
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
GlobalReAlloc
LocalAlloc
LocalLock
LocalUnlock
GetProfileStringW
CreateFileW
GetFileAttributesW
_lwrite
OpenFile
_llseek
_lclose
ReleaseMutex
CreateMutexW
TlsFree
TlsAlloc
TlsGetValue
TlsSetValue
GetFullPathNameW
GetVersionExW
CreateProcessW
GetLastError
LocalFree
LoadLibraryExW
FindResourceW
LoadResource
LockResource
GlobalAlloc
GetModuleHandleW
GetOEMCP
GetACP
GetThreadLocale
GetCurrentThreadId
GetCommandLineW
DeleteFileW
CreateSemaphoreW
CloseHandle
CreateThread
ReleaseSemaphore
CreateEventW
ResetEvent
GetSystemDirectoryA
LoadLibraryA
WaitForSingleObject
SetEvent
Sleep
lstrcatW
GlobalFree
GlobalLock
MulDiv
GlobalUnlock
lstrcmpiW
WinExec
lstrcmpW
lstrcpynW
LoadLibraryW
GetProcAddress
lstrlenW
lstrcpyW
GetModuleFileNameW
FreeLibrary
FormatMessageW
SetStdHandle
SetEnvironmentVariableA

user32

GetMenuItemID
IsDlgButtonChecked
CheckDlgButton
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DefFrameProcW
DeleteMenu
EnumWindows
keybd_event
mouse_event
GetMenuItemRect
FindWindowExW
CharNextW
UpdateLayeredWindow
IsCharAlphaW
MonitorFromRect
LoadKeyboardLayoutW
DialogBoxParamW
DrawTextExW
WindowFromDC
DestroyCursor
InsertMenuItemW
IsCharAlphaNumericW
LoadStringW
LoadAcceleratorsW
wvsprintfW
IsMenu
MonitorFromWindow
MapWindowPoints
RegisterWindowMessageW
CopyIcon
SetRectEmpty
TrackPopupMenuEx
SetWindowRgn
GetAsyncKeyState
GetKeyboardState
GetCursor
wsprintfA
DrawEdge
TabbedTextOutW
GetMenuState
SetDlgItemInt
GetDlgItemInt
GetDlgItemTextW
LoadBitmapW
SetScrollInfo
GetClassInfoExW
UnionRect
MonitorFromPoint
GetMonitorInfoW
GetClassInfoW
GetCapture
TrackMouseEvent
CreateIconFromResourceEx
GetIconInfo
CreateIconIndirect
InvalidateRect
WindowFromPoint
GetDoubleClickTime
SetPropW
RemovePropW
GetPropW
GetWindowThreadProcessId
SubtractRect
CreatePopupMenu
ChildWindowFromPoint
SetMenuDefaultItem
GetKeyNameTextW
LoadImageW
GetCursorPos
OffsetRect
IsRectEmpty
MapDialogRect
GetSysColorBrush
DrawStateW
GetMessagePos
PtInRect
GetMenuItemCount
TrackPopupMenu
SetParent
SetMenuItemInfoW
DrawMenuBar
UnregisterClassW
SetMenu
CreateMDIWindowW
ChildWindowFromPointEx
GetMessageTime
SetActiveWindow
GetMenuBarInfo
ScreenToClient
RedrawWindow
DrawIconEx
GetActiveWindow
GetWindowDC
ClientToScreen
SendInput
RemoveMenu
GetWindow
GetDlgCtrlID
DefMDIChildProcW
GetForegroundWindow
MsgWaitForMultipleObjects
BringWindowToTop
SetForegroundWindow
GetScrollInfo
CallWindowProcW
DdeEnableCallback
DdeGetData
GetDesktopWindow
DefDlgProcW
RegisterClipboardFormatW
LoadMenuW
DdeConnect
DdeInitializeW
DdeCreateDataHandle
DdeQueryStringW
DdeNameService
DdeGetLastError
DdeUninitialize
DdeDisconnect
DdeAccessData
DdeUnaccessData
DdeCreateStringHandleW
DdeFreeStringHandle
PeekMessageW
IsWindow
SetCursor
ShowCursor
DestroyCaret
EnumChildWindows
ScrollWindowEx
CreateCaret
SetClassLongW
IntersectRect
InvertRect
EqualRect
GetClipboardData
GetClassLongW
MoveWindow
CheckRadioButton
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
EnableWindow
SetClipboardViewer
GetClassNameW
FindWindowW
RegisterClassExW
DestroyIcon
AdjustWindowRectEx
CreateMenu
CreateWindowExW
GetMenuItemInfoW
VkKeyScanW
LoadCursorW
RegisterClassW
FillRect
InflateRect
FrameRect
DrawFrameControl
DrawTextW
DrawFocusRect
SetCapture
ReleaseCapture
GetSubMenu
ShowCaret
IsWindowVisible
ShowWindow
GetSystemMenu
SetCaretPos
GetMessageW
IsWindowEnabled
TranslateMessage
IsDialogMessageW
DispatchMessageW
SystemParametersInfoW
HideCaret
NotifyWinEvent
GetKeyState
MapVirtualKeyW
SetScrollRange
SetScrollPos
ShowScrollBar
SetWindowPlacement
GetKeyboardLayout
DrawIcon
ChangeClipboardChain
DestroyMenu
PostQuitMessage
WinHelpW
DestroyWindow
GetMenu
IsClipboardFormatAvailable
EnableMenuItem
CheckMenuItem
PostThreadMessageW
SendNotifyMessageW
GetFocus
EndDialog
GetDlgItem
GetWindowTextLengthW
SetFocus
GetWindowTextW
LoadIconW
MessageBeep
PostMessageW
KillTimer
SetTimer
GetWindowRect
GetParent
GetWindowPlacement
UpdateWindow
BeginPaint
GetClientRect
EndPaint
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetWindowLongW
DefWindowProcW
SetWindowPos
GetWindowLongW
SetRect
AdjustWindowRect
GetSystemMetrics
IsIconic
IsZoomed
CopyRect
wsprintfW
GetSysColor
GetDC
ReleaseDC
DialogBoxIndirectParamW
CreateDialogIndirectParamW
InsertMenuW
AppendMenuW
SendMessageW
SendDlgItemMessageW
SetDlgItemTextW
MessageBoxW
SetWindowTextW
DdeClientTransaction
UnregisterClassA

advapi32

RegQueryValueExW
CryptDestroyKey
RegSetValueExA
RegOpenCurrentUser
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
AddAccessAllowedAce
AddAccessDeniedAce
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
LookupAccountNameW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyW
InitializeAcl
RegGetKeySecurity
GetSecurityDescriptorDacl
GetAce
SetSecurityInfo
OpenProcessToken
GetTokenInformation
GetLengthSid
RegQueryInfoKeyW
GetUserNameW
CryptSignHashW
CryptHashData
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptCreateHash
CryptDestroyHash

gdi32

CreateDCW
GetCurrentObject
CreatePen
Polyline
PatBlt
BitBlt
ExcludeClipRect
Polygon
CreateDIBSection
GdiFlush
CreatePalette
GetPixel
SetDIBits
GetNearestPaletteIndex
StretchBlt
SetBrushOrgEx
GetBrushOrgEx
SetMetaFileBitsEx
DeleteMetaFile
GetSystemPaletteEntries
SelectClipRgn
CreateRectRgn
SetViewportOrgEx
RestoreDC
PlayMetaFile
Rectangle
SetViewportExtEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SaveDC
CombineRgn
GetClipRgn
DeleteDC
GetTextColor
GetTextExtentPoint32W
GetBkColor
GetCharWidth32W
EnumFontFamiliesW
CreateICW
TranslateCharsetInfo
Ellipse
GetObjectA
OffsetRgn
CreateRectRgnIndirect
FillRgn
ExtSelectClipRgn
GetNearestColor
LineTo
RoundRect
ExtCreatePen
SetDIBitsToDevice
SetBkColor
SetTextColor
CreateFontIndirectW
UnrealizeObject
DeleteObject
SetBkMode
SelectPalette
RealizePalette
SetStretchBltMode
StretchDIBits
SelectObject
GetTextFaceW
GetTextMetricsW
GetStockObject
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
GetCharWidthW
GetCurrentPositionEx
SetAbortProc
GetTextExtentPointW
AbortDoc
GetDIBits
StartDocW
StartPage
SetTextAlign
MoveToEx
TextOutW
EndPage
EndDoc
GetDeviceCaps
AddFontResourceW
RemoveFontResourceW
ExtTextOutW
GetViewportOrgEx
CreateSolidBrush

ws2_32

WSACreateEvent
WSAStartup
ntohl
gethostname
getsockopt
WSAWaitForMultipleEvents
bind
ioctlsocket
WSACloseEvent
WSASetEvent
WSAEnumNetworkEvents
WSAResetEvent
WSAEventSelect
getpeername
getsockname
setsockopt
socket
connect
closesocket
shutdown
accept
ntohs
getservbyport
gethostbyaddr
htonl
inet_ntoa
gethostbyname
inet_addr
getservbyname
WSACleanup
htons
recv
WSAGetLastError
select
send
listen
WSASetLastError

shell32

ShellExecuteA
SHGetSpecialFolderLocation
CommandLineToArgvW
SHGetFileInfoW
ExtractIconW
ExtractIconExW
DuplicateIcon
SHChangeNotify
SHFileOperationW
DragAcceptFiles
SHGetSpecialFolderPathW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
DragQueryPoint
DragFinish
ShellExecuteW
Shell_NotifyIconW

winspool.drv

EndDocPrinter
StartDocPrinterW
StartPagePrinter
WritePrinter
GetPrinterW
DocumentPropertiesW
OpenPrinterW
EndPagePrinter
ClosePrinter

comdlg32

ChooseColorW
GetOpenFileNameW
CommDlgExtendedError
PageSetupDlgW
ChooseFontW
PrintDlgW
GetSaveFileNameW

ole32

CoInitializeEx
OleInitialize
OleUninitialize
CoUninitialize
CLSIDFromString
CreateStreamOnHGlobal
StgCreateDocfile
CoGetClassObject
RevokeDragDrop
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
ReleaseStgMedium
StgCreateStorageEx
RegisterDragDrop
CoSetProxyBlanket
CoInitializeSecurity
StringFromIID
CreateBindCtx
MkParseDisplayName
CLSIDFromProgID
DoDragDrop
CoTaskMemRealloc
StringFromCLSID
CoTaskMemFree

gdiplus

GdipSetStringFormatAlign
GdipDrawImageI
GdipCloneImage
GdipSetLineBlend
GdipSetStringFormatFlags
GdipCreateTexture
GdipCreateLineBrushFromRectWithAngleI
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathArcI
GdipGetSmoothingMode
GdipDrawArcI
GdipFillPath
GdiplusShutdown
GdiplusStartup
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipCreateBitmapFromHICON
GdipGetImageBounds
GdipDisposeImage
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipSetStringFormatHotkeyPrefix
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawLinesI
GdipCloneRegion
GdipCombineRegionRectI
GdipDrawPath
GdipDrawLineI
GdipTranslateWorldTransform
GdipSetSmoothingMode
GdipCreatePen1
GdipCloneBrush
GdipRestoreGraphics
GdipSaveGraphics
GdipSetClipRegion
GdipSetClipRectI
GdipGetPenWidth
GdipCreateSolidFill
GdipDeletePen
GdipCreatePen2
GdipDeleteBrush
GdipAlloc
GdipCreateRegion
GdipGetClip
GdipFillRectangleI
GdipGetWorldTransform
GdipReleaseDC
GdipGetDC
GdipCreateFromHWND
GdipCreateFromHDC
GdipGetMatrixElements
GdipCreateMatrix
GdipFree
GdipIsEmptyRegion
GdipGetRegionHRgn
GdipDeleteRegion
GdipDeleteGraphics
GdipDeletePath
GdipCreatePath
GdipDeleteMatrix
GdipLoadImageFromFile

secur32

GetUserNameExW
QueryContextAttributesW

iphlpapi

NotifyAddrChange

oleacc

AccessibleObjectFromWindow
LresultFromObject

crypt32

CertEnumCertificatesInStore
CertOpenStore
CertDeleteCertificateFromStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertSaveStore
CertCreateCertificateContext
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertCloseStore
CertFreeCertificateContext

cryptui

CryptUIDlgViewCertificateW

msimg32

GradientFill

Exports

Exports

_KClient@16
_KClientLoadError@16
_KClientSnoop@8
_RegisterAboutControl@8
_RegisterOurDlgControl@8
_SetInternal@0

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

K_BSS
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 877KB - Virtual size: 877KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

K_DATA
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_text
Size: 512B - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ba7638ef0ae3030b71c1b95892ca5e7e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

oleaut32

imm32

version

winmm

kernel32

user32

advapi32

gdi32

ws2_32

shell32

winspool.drv

comdlg32

ole32

gdiplus

secur32

iphlpapi

oleacc

crypt32

cryptui

msimg32

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

K_BSS Size: - Virtual size: 42KB

.rdata Size: 877KB - Virtual size: 877KB

.data Size: 37KB - Virtual size: 45KB

K_DATA Size: 25KB - Virtual size: 25KB

_text Size: 512B - Virtual size: 1B

.rsrc Size: 817KB - Virtual size: 817KB

.reloc Size: 205KB - Virtual size: 205KB

.text
Size: 2.3MB - Virtual size: 2.3MB

K_BSS
Size: - Virtual size: 42KB

.rdata
Size: 877KB - Virtual size: 877KB

.data
Size: 37KB - Virtual size: 45KB

K_DATA
Size: 25KB - Virtual size: 25KB

_text
Size: 512B - Virtual size: 1B

.rsrc
Size: 817KB - Virtual size: 817KB

.reloc
Size: 205KB - Virtual size: 205KB