2024-06-05_e6eb1436855c88bf381fdd53cead00db_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-05_e6eb1436855c88bf381fdd53cead00db_mafia
Size

824KB
MD5

e6eb1436855c88bf381fdd53cead00db
SHA1

2ac22885bd4efa2a5c22bce3e3ee9f3f09d8428c
SHA256

24e65205219ab41489cc4ce24b0b5a3eee55c9699e29ee3adab46a4bad548ea0
SHA512

9346fa93afafd51ef424c3619bb865f83da4204c74256dea6a8be163a541de4361e4e23bded55c97d2b8f6c038c689de6c760dbc2db54a919dcf7d23a1a0bb38
SSDEEP

12288:P/DeIQrOxXrBvz+T/o78F2iropvIGclRBFVwAzfcUo:zedrTUiro7clRBFVXz8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-05_e6eb1436855c88bf381fdd53cead00db_mafia

Files

2024-06-05_e6eb1436855c88bf381fdd53cead00db_mafia
.exe windows:5 windows x86 arch:x86

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryExW
GlobalFree
GlobalHandle
CloseHandle
GetCurrentProcessId
CreateFileW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineW
GetLocalTime
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryW
WriteFile
SetFilePointer
GetFileSize
InitializeCriticalSection
WideCharToMultiByte
lstrlenA
GetTickCount
VirtualProtect
WriteProcessMemory
CreateDirectoryW
Sleep
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
LocalFree
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
GetLocaleInfoW
InterlockedExchange
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapCreate
GetSystemTimeAsFileTime
ExitProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
RaiseException
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushInstructionCache
GetCurrentProcess
FreeLibrary
SetLastError
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GlobalAlloc

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassA
FindWindowExW
SetWindowLongW
DestroyWindow
DefWindowProcW
SetWindowPos
MoveWindow
GetWindowLongW
GetSysColor
PtInRect
OffsetRect
IntersectRect
UnionRect
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
EnumChildWindows
SetActiveWindow
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
GetSystemMetrics
DestroyAcceleratorTable
SetFocus
GetWindow
GetFocus
SendMessageW
IsWindow
GetClassInfoExW
AnimateWindow
ShowWindow
BringWindowToTop
SetForegroundWindow
OpenClipboard
SystemParametersInfoW
EnableWindow
PostMessageW
SetTimer
KillTimer
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsRectEmpty
SendDlgItemMessageW
SetWindowsHookExW
CallNextHookEx
GetAncestor
UnhookWindowsHookEx
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW

gdi32

GetObjectW
DeleteObject
GetStockObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
OleRun
CoGetClassObject
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
OleLockRunning
ProgIDFromCLSID
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

OleCreateFontIndirect
SysStringLen
VarBstrCmp
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
DispCallFunc
GetErrorInfo
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString

urlmon

UrlMkSetSessionOption
CoInternetGetSession
ObtainUserAgentString

wininet

HttpAddRequestHeadersW
InternetOpenW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetCrackUrlW

dsound

ord1

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToDataEx

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

EnumProcessModules

winmm

PlaySoundA
waveOutWrite
midiStreamOut
PlaySoundW

wintrust

WinVerifyTrust

crypt32

CertOpenStore

Sections

.text
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 202KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

wininet

dsound

dbghelp

version

psapi

winmm

wintrust

crypt32

Sections

.text Size: 351KB - Virtual size: 351KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 12KB - Virtual size: 21KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 202KB - Virtual size: 29KB

.text
Size: 351KB - Virtual size: 351KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 202KB - Virtual size: 29KB