2024-06-06_1ee01ba512e463ecc484fb32e922e07a_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-06_1ee01ba512e463ecc484fb32e922e07a_mafia
Size

11.0MB
MD5

1ee01ba512e463ecc484fb32e922e07a
SHA1

7580e7b55386fe580cf6d348870441e9a226bbd3
SHA256

ce1df1bb9393e5f261fa644f017d47dacbfe173005f1b6bfdd460653902cd924
SHA512

8a70f9a034df95e268845f4088983fb73c24669d7126857822be8a9461d9cc0890f334287a05bbcaad72dffebf8cb61d7511bb24b00a3013de6660af1e1064b6
SSDEEP

196608:0AVqLoZgz5b3DcZIGCRwGCRBmuTchUutLSI7RPyuTNnWhSabnLtBluAiwJtv7u9l:0Ac+gNDDcKBKBHmuTUlvOzjAAiQtKJPW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-06_1ee01ba512e463ecc484fb32e922e07a_mafia

Files

2024-06-06_1ee01ba512e463ecc484fb32e922e07a_mafia
.exe windows:5 windows x86 arch:x86

48045cd8242834576105c702759db573

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dabao20\RootGUI\Release\RootGUI.pdb

Imports

kernel32

EnterCriticalSection
SleepEx
FormatMessageA
GetTickCount
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
GetCurrentDirectoryW
LoadLibraryW
GetModuleHandleW
GetACP
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
DuplicateHandle
GetCurrentProcess
SystemTimeToFileTime
CreateDirectoryW
MulDiv
InterlockedIncrement
InterlockedDecrement
FindFirstFileW
SetHandleInformation
GetExitCodeProcess
FindClose
SetNamedPipeHandleState
CreatePipe
FindNextFileW
DeviceIoControl
GetTimeFormatA
DeleteFileA
MoveFileA
LoadLibraryExA
SetEnvironmentVariableA
CompareStringW
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
GetDriveTypeW
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
SetStdHandle
GetFullPathNameA
IsProcessorFeaturePresent
GetConsoleMode
GetConsoleCP
HeapSize
IsValidCodePage
GetOEMCP
QueryPerformanceCounter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RaiseException
RtlUnwind
GetFileInformationByHandle
ExitThread
GetSystemTimeAsFileTime
FindFirstFileExA
GetDriveTypeA
FileTimeToSystemTime
HeapReAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapAlloc
HeapFree
InterlockedExchange
DecodePointer
EncodePointer
IsValidLocale
InitializeCriticalSection
SetLastError
GetFileAttributesW
GetFileAttributesA
ReleaseMutex
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
CreateMutexW
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileTime
SetFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
WriteFile
SetFilePointer
CreateFileA
LocalFree
GetTempPathA
CreateMutexA
GetModuleFileNameA
GetTempPathW
GetModuleFileNameW
CopyFileW
OpenProcess
CreateProcessW
GetCommandLineW
WaitForSingleObject
CreateThread
WaitForMultipleObjects
GetFileSize
GetTempFileNameA
GetLastError
CreateProcessA
Sleep
TerminateThread
WideCharToMultiByte
ExitProcess
CloseHandle
MultiByteToWideChar
CreateFileW
ReadFile
EnumSystemLocalesA
GetDateFormatA

user32

GetWindowTextW
GetWindowTextLengthW
IntersectRect
FillRect
DrawTextW
CharPrevW
SetRect
CreateCaret
CharNextW
HideCaret
MessageBoxW
SetWindowLongW
GetWindowLongW
SetWindowTextW
ShowCaret
IsIconic
PostQuitMessage
SetCaretPos
ClientToScreen
GetSysColor
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
ScreenToClient
SetWindowRgn
SwitchToThisWindow
BringWindowToTop
FindWindowExA
PostMessageW
GetWindowThreadProcessId
EnumWindows
DefWindowProcW
IsWindow
ShowWindow
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
InvalidateRgn
MoveWindow
CreateAcceleratorTableW
GetClientRect
SetWindowPos
SystemParametersInfoW
GetParent
SendMessageW
CallWindowProcW
GetPropW
SetPropW
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
GetKeyState
GetDC
InvalidateRect
SetTimer
KillTimer
SetCapture
ReleaseCapture
PtInRect
ReleaseDC
DestroyWindow
wvsprintfW
SetCursor
GetFocus
MapWindowPoints
TrackMouseEvent
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetCursorPos
OffsetRect
InflateRect

gdi32

SelectClipRgn
SetBkMode
SetTextColor
CreateSolidBrush
CreateCompatibleDC
SaveDC
BitBlt
RestoreDC
Rectangle
SetWindowOrgEx
DeleteDC
CreatePen
GetStockObject
GetObjectW
CreateFontIndirectW
ExtSelectClipRgn
GetTextMetricsW
DeleteObject
CreateRoundRectRgn
ExtTextOutW
SetBkColor
LineTo
MoveToEx
CreatePenIndirect
RoundRect
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
GetDeviceCaps
GetObjectA
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
CreateDIBSection
SelectObject
CreateCompatibleBitmap
SetStretchBltMode

advapi32

CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptGetHashParam

shell32

SHGetSpecialFolderPathA
SHCreateDirectoryExW
SHCreateDirectoryExA
CommandLineToArgvW
ShellExecuteA
SHGetSpecialFolderPathW

ole32

OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

gdiplus

GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushI
GdiplusStartup
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipDeleteBrush
GdiplusShutdown

psapi

GetModuleFileNameExW
GetProcessImageFileNameW
EnumProcesses

ws2_32

gethostname
select
__WSAFDIsSet
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
send
recv
WSAGetLastError
WSAStartup
WSACleanup
ioctlsocket

iphlpapi

GetAdaptersInfo

wldap32

ord50
ord60
ord143
ord211
ord22
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46

Sections

.text
Size: 765KB - Virtual size: 765KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 365KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48045cd8242834576105c702759db573

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

psapi

ws2_32

iphlpapi

wldap32

Sections

.text Size: 765KB - Virtual size: 765KB

.rdata Size: 176KB - Virtual size: 176KB

.data Size: 9.6MB - Virtual size: 9.6MB

.rsrc Size: 365KB - Virtual size: 364KB

.reloc Size: 68KB - Virtual size: 67KB

.text
Size: 765KB - Virtual size: 765KB

.rdata
Size: 176KB - Virtual size: 176KB

.data
Size: 9.6MB - Virtual size: 9.6MB

.rsrc
Size: 365KB - Virtual size: 364KB

.reloc
Size: 68KB - Virtual size: 67KB