2024-06-03_4893e4fe90718e5455962cd38f2e65fa_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-03_4893e4fe90718e5455962cd38f2e65fa_mafia
Size

507KB
MD5

4893e4fe90718e5455962cd38f2e65fa
SHA1

4d40ca330acf661d1bf6f920ef62f80020d803e1
SHA256

0b95f73488ffd1cfd805ddf548a4825a428cb899a9de86dcaf1d268a24949551
SHA512

16600f44d47759d95aa4ae4a8fd6c19d7ec937b095e047ccf65fc5dfeb64634214fff1e2d633b80086dfe07fbf2ffe7dd771b520a933b19ed54a57d0cdb75bef
SSDEEP

12288:M/DeIQrOxXrBvz+T/o78F2iropvIGclRBFVwAzfcUo:wedrTUiro7clRBFVXz8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_4893e4fe90718e5455962cd38f2e65fa_mafia

Files

2024-06-03_4893e4fe90718e5455962cd38f2e65fa_mafia
.exe windows:5 windows x86 arch:x86

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryExW
GlobalFree
GlobalHandle
CloseHandle
GetCurrentProcessId
CreateFileW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineW
GetLocalTime
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryW
WriteFile
SetFilePointer
GetFileSize
InitializeCriticalSection
WideCharToMultiByte
lstrlenA
GetTickCount
VirtualProtect
WriteProcessMemory
CreateDirectoryW
Sleep
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
LocalFree
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
GetLocaleInfoW
InterlockedExchange
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapCreate
GetSystemTimeAsFileTime
ExitProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
RaiseException
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushInstructionCache
GetCurrentProcess
FreeLibrary
SetLastError
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GlobalAlloc

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassA
FindWindowExW
SetWindowLongW
DestroyWindow
DefWindowProcW
SetWindowPos
MoveWindow
GetWindowLongW
GetSysColor
PtInRect
OffsetRect
IntersectRect
UnionRect
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
EnumChildWindows
SetActiveWindow
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
GetSystemMetrics
DestroyAcceleratorTable
SetFocus
GetWindow
GetFocus
SendMessageW
IsWindow
GetClassInfoExW
AnimateWindow
ShowWindow
BringWindowToTop
SetForegroundWindow
OpenClipboard
SystemParametersInfoW
EnableWindow
PostMessageW
SetTimer
KillTimer
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsRectEmpty
SendDlgItemMessageW
SetWindowsHookExW
CallNextHookEx
GetAncestor
UnhookWindowsHookEx
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW

gdi32

GetObjectW
DeleteObject
GetStockObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
OleRun
CoGetClassObject
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
OleLockRunning
ProgIDFromCLSID
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

OleCreateFontIndirect
SysStringLen
VarBstrCmp
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
DispCallFunc
GetErrorInfo
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString

urlmon

UrlMkSetSessionOption
CoInternetGetSession
ObtainUserAgentString

wininet

HttpAddRequestHeadersW
InternetOpenW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetCrackUrlW

dsound

ord1

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToDataEx

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

EnumProcessModules

winmm

PlaySoundA
waveOutWrite
midiStreamOut
PlaySoundW

wintrust

WinVerifyTrust

crypt32

CertOpenStore

Sections

.text
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

wininet

dsound

dbghelp

version

psapi

winmm

wintrust

crypt32

Sections

.text Size: 351KB - Virtual size: 351KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 12KB - Virtual size: 21KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 57KB - Virtual size: 58KB

.text
Size: 351KB - Virtual size: 351KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 57KB - Virtual size: 58KB