2024-06-07_26af8ba9c58f10a36ad1583c1ca33d4c_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_26af8ba9c58f10a36ad1583c1ca33d4c_mafia
Size

1.9MB
MD5

26af8ba9c58f10a36ad1583c1ca33d4c
SHA1

630dc9d12d42b7e5a655e9bf24d960c6ec0ba3f2
SHA256

ccd00637229b2d824f0505fd241af245e40eaa1fa43039b72dddb9beaa50afbf
SHA512

566287145808ab7ba0bfceb8e30d64fdd4013bf807532bba984c1e8783dc312d4c383ea022b8bd971c0d31d7d106c855e55555879ff714fea6be2d78f3194acd
SSDEEP

49152:DLhr5oknoz/cTjpBdTcs5bhgB9JXgu1u9CBwA9:Dd5om+/cTjpp5bWBfw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_26af8ba9c58f10a36ad1583c1ca33d4c_mafia

Files

2024-06-07_26af8ba9c58f10a36ad1583c1ca33d4c_mafia
.exe windows:5 windows x86 arch:x86

685bd11843ffbd37f4bbe340acfd15e6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CreateFileW
InitializeCriticalSection
WriteConsoleW
SetStdHandle
GetStringTypeW
CloseHandle
LCMapStringW
FlushFileBuffers
GetConsoleCP
SetFilePointer
ReadFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
LockResource
LoadLibraryA
GetProcAddress
MultiByteToWideChar
SizeofResource
LoadLibraryW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
WriteFile
InterlockedDecrement
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
GetModuleHandleW
Sleep
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
LoadResource
FindResourceW
GetConsoleMode
FindResourceExW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
DecodePointer
EncodePointer
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
SetEndOfFile
RaiseException

gdi32

TextOutW
EndDoc
PlayEnhMetaFileRecord
AddFontResourceExW
GetRegionData
GetEnhMetaFileHeader
AngleArc
GetMetaFileW
CreateDIBSection
GetROP2
GetOutlineTextMetricsA
GetTextExtentPoint32A
GetGlyphOutlineA
SetWorldTransform

oleaut32

SysFreeString
SysStringByteLen
SysAllocString
SysAllocStringByteLen
VarBstrCmp
SysAllocStringLen

advapi32

SetAclInformation
GetServiceKeyNameA
RegSetValueExW
RegUnLoadKeyW

imagehlp

SetImageConfigInformation
ImagehlpApiVersion

oledlg

OleUIChangeIconW
ord12
ord7
OleUIChangeSourceW
OleUIUpdateLinksW
OleUIObjectPropertiesW
ord4
OleUIPasteSpecialW
ord1
OleUIConvertW
OleUIEditLinksW
ord6
ord9

version

VerInstallFileW
GetFileVersionInfoSizeA

crypt32

CryptImportPublicKeyInfoEx
CryptMemFree
CertStrToNameA
CryptQueryObject
CertAddCTLLinkToStore
CertDuplicateStore

winhttp

WinHttpQueryOption
WinHttpReceiveResponse
WinHttpTimeFromSystemTime
WinHttpQueryAuthSchemes
WinHttpReadData
WinHttpOpenRequest
WinHttpOpen
WinHttpSetStatusCallback
WinHttpSendRequest

powrprof

EnumPwrSchemes
WriteProcessorPwrScheme
WritePwrScheme
CanUserWritePwrScheme
DeletePwrScheme
GetActivePwrScheme
CallNtPowerInformation
GetCurrentPowerPolicies
ReadProcessorPwrScheme
WriteGlobalPwrPolicy
SetActivePwrScheme
IsPwrSuspendAllowed
ReadGlobalPwrPolicy
IsPwrHibernateAllowed
ReadPwrScheme

imm32

ImmGetCandidateListA
ImmGetContext
ImmRegisterWordA

resutils

ResUtilExpandEnvironmentStrings
ResUtilGetResourceDependency
ResUtilFindLongProperty
ResUtilFindDependentDiskResourceDriveLetter
ResUtilVerifyService

uxtheme

GetThemePartSize
DrawThemeBackground
IsThemeBackgroundPartiallyTransparent
IsThemePartDefined
GetThemeMetric
GetThemeRect
GetCurrentThemeName
GetThemePropertyOrigin
EnableTheming
GetThemeTextMetrics
GetThemeIntList
GetThemeEnumValue
GetThemeMargins

p2p

PeerGroupAddRecord
PeerGroupCloseDirectConnection
PeerGroupShutdown
PeerGroupGetRecord

oleacc

GetRoleTextW
CreateStdAccessibleProxyA
GetRoleTextA
GetStateTextW
AccessibleObjectFromEvent
ObjectFromLresult
GetStateTextA
AccessibleObjectFromPoint
WindowFromAccessibleObject
CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

secur32

ImpersonateSecurityContext
InitializeSecurityContextA
TranslateNameA
QueryContextAttributesA
SealMessage

psapi

EnumProcesses
GetMappedFileNameW
GetModuleFileNameExW
EnumDeviceDrivers
GetProcessImageFileNameW
EmptyWorkingSet
InitializeProcessForWsWatch
GetMappedFileNameA
GetDeviceDriverBaseNameA
GetModuleBaseNameA
GetWsChanges
GetModuleInformation
GetDeviceDriverFileNameW
QueryWorkingSet
GetModuleBaseNameW

Sections

.text
Size: 990KB - Virtual size: 989KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 589KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 149KB - Virtual size: 780KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

685bd11843ffbd37f4bbe340acfd15e6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

gdi32

oleaut32

advapi32

imagehlp

oledlg

version

crypt32

winhttp

powrprof

imm32

resutils

uxtheme

p2p

oleacc

secur32

psapi

Sections

.text Size: 990KB - Virtual size: 989KB

.rdata Size: 170KB - Virtual size: 170KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 589KB - Virtual size: 588KB

.reloc Size: 149KB - Virtual size: 780KB

.text
Size: 990KB - Virtual size: 989KB

.rdata
Size: 170KB - Virtual size: 170KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 589KB - Virtual size: 588KB

.reloc
Size: 149KB - Virtual size: 780KB