2024-06-08_0d7f18e8dfba42736d7ba0b5d32f2f57_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-08_0d7f18e8dfba42736d7ba0b5d32f2f57_mafia
Size 2.5MB
Sample240608-hvdgfaba46
SHA256 18857010e630f895663af24b62ad10a33aaf1500bb96ecdf59aa9ba1ab621cf0
MD5 0d7f18e8dfba42736d7ba0b5d32f2f57
SHA1 4c9f4dc3e2e5b75973b5afa8f78a7673dd6ff6f7
SHA512 48b78dd0a2ca673ff81aa2aa98a71995fb5c4a0fe090ba0d62148fbea00ff7540e188974edef412691fca90ae42a85ed1849757930b02cf124ab5bf2adc43dbf
SSDEEP 49152:LfEIIs7mpMDVairDHjoYM3C9sPZowhxPR+T9Lcq347gBN:TEI0pMDVaivHsfS9+ZjeLW7i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-08_0d7f18e8dfba42736d7ba0b5d32f2f57_mafia

File Explorer

2024-06-08_0d7f18e8dfba42736d7ba0b5d32f2f57_mafia

.exe 2.5MB

2024-06-08_0d7f18e8dfba42736d7ba0b5d32f2f57_mafia

IMPHASH 8042b7649759bf6732b280ef8142f9db
SHA256 18857010e630f895663af24b62ad10a33aaf1500bb96ecdf59aa9ba1ab621cf0
MD5 0d7f18e8dfba42736d7ba0b5d32f2f57
SHA1 4c9f4dc3e2e5b75973b5afa8f78a7673dd6ff6f7
SHA512 48b78dd0a2ca673ff81aa2aa98a71995fb5c4a0fe090ba0d62148fbea00ff7540e188974edef412691fca90ae42a85ed1849757930b02cf124ab5bf2adc43dbf
SSDEEP 49152:LfEIIs7mpMDVairDHjoYM3C9sPZowhxPR+T9Lcq347gBN:TEI0pMDVaivHsfS9+ZjeLW7i
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize CreateFileW QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress LoadLibraryW GetCurrentProcess GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement Sleep InterlockedExchange DeleteCriticalSection EncodePointer DecodePointer RaiseException RtlUnwind GetCommandLineA HeapSetInformation GetStartupInfoW HeapFree HeapAlloc GetSystemTimeAsFileTime LCMapStringW GetCPInfo IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess UnhandledExceptionFilter CloseHandle IsDebuggerPresent HeapSize ExitProcess GetStdHandle GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteFile SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType HeapCreate GetTickCount GetTimeZoneInformation GetConsoleCP GetConsoleMode FlushFileBuffers GetStringTypeW HeapReAlloc GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileA WriteConsoleW SetEndOfFile GetProcessHeap CompareStringW SetEnvironmentVariableA SetFilePointer OutputDebugStringW GetCommandLineW SetUnhandledExceptionFilter ReadFile SetCurrentDirectoryW lstrlenA OutputDebugStringA VirtualAlloc VirtualFree GetSystemInfo UnmapViewOfFile GetVersionExA CreateFileMappingA MapViewOfFile LoadLibraryA lstrcmpiA GetFullPathNameA InterlockedCompareExchange GetDateFormatA GetTimeFormatA GetSystemTime LocalFree GetCurrentThreadId GetModuleHandleA SetLastError GetModuleHandleW GetModuleFileNameW GetLastError CreateThread SetThreadPriority FindNextFileW FindFirstFileW FindClose CreateDirectoryW DeleteFileW GetEnvironmentStringsW

user32

CharToOemBuffW OemToCharBuffW PeekMessageW TranslateMessage FindWindowW LoadAcceleratorsA LoadIconA DispatchMessageW LoadCursorA RegisterClassExW GetWindowLongW GetKeyboardState ToUnicode GetMonitorInfoA EnumDisplayMonitors UpdateWindow ShowWindow SetWindowLongW CreateWindowExW SetForegroundWindow SetWindowPos ReleaseCapture AdjustWindowRect DestroyWindow DefWindowProcW GetWindowPlacement EndPaint BeginPaint

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoInitialize CoUninitialize

magic

Magic_IsInterval1 Magic_SetEmitterPosition Magic_SetEmitterPositionMode Magic_Restart Magic_IsInterrupt Magic_SetInterrupt Magic_Stop Magic_InInterval Magic_EmitterToInterval1 Magic_OpenFileInMemory Magic_GetStaticAtlas Magic_SetCurrentFolder Magic_FindFirst Magic_FindNext Magic_LoadEmitter Magic_GetFileName Magic_HasTextures Magic_SetInterpolationMode Magic_SetLoopMode Magic_GetStaticAtlasCount Magic_CreateFirstRenderedParticlesList Magic_GetNextParticleVertexes Magic_CreateNextRenderedParticlesList Magic_SetEmitterDirection Magic_Update Magic_GetUpdateTime Magic_IsInterpolationMode Magic_GetEmitterPosition Magic_DuplicateEmitter

bass

BASS_ChannelPlay BASS_ChannelRemoveSync BASS_ChannelSetSync BASS_ChannelSlideAttribute BASS_Start BASS_SampleGetChannel BASS_ChannelStop BASS_Init BASS_StreamFree BASS_StreamCreateFileUser BASS_SampleLoad BASS_Pause BASS_ChannelSetAttribute BASS_SampleFree BASS_ChannelIsActive

shlwapi

StrCpyW

d3d9

Direct3DCreate9

gdi32

DeleteObject

_iBindImageTemp@0 _iConvertImage@12 _iConvertPal@8 _iCopyPal@0 _iFlipBuffer@16 _iGetFlipped@4 _iGetIntegervImage@12 _iMemSwap@12 _iMirror@0 _ialloc@4 _icalloc@8 _ifree@4 _ilActiveFace@4 _ilActiveImage@4 _ilActiveLayer@4 _ilActiveMipmap@4 _ilApplyPal@4 _ilBindImage@4 _ilBlit@40 _ilClampNTSC@0 _ilClearColour@16 _ilClearImage@0 _ilClearImage_@4 _ilCloneCurImage@0 _ilCloseImage@4 _ilClosePal@4 _ilCompressDXT@24 _ilCompressFunc@4 _ilConvertBuffer@28 _ilConvertImage@8 _ilConvertPal@4 _ilCopyImage@4 _ilCopyImageAttr@8 _ilCopyImage_@4 _ilCopyPixels@36 _ilCreateSubImage@8 _ilDefaultImage@0 _ilDeleteImage@4 _ilDeleteImages@8 _ilDetermineType@4 _ilDetermineTypeF@4 _ilDetermineTypeL@8 _ilDisable@4 _ilDxtcDataToImage@0 _ilDxtcDataToSurface@0 _ilEnable@4 _ilFlipSurfaceDxtcData@0 _ilFormatFunc@4 _ilGenImage@0 _ilGenImages@8 _ilGetAlpha@4 _ilGetBoolean@4 _ilGetBooleanv@8 _ilGetBpcType@4 _ilGetBppFormat@4 _ilGetBppPal@4 _ilGetClear@12 _ilGetCurImage@0 _ilGetCurName@0 _ilGetDXTCData@12 _ilGetData@0 _ilGetError@0 _ilGetFormatBpp@4 _ilGetInteger@4 _ilGetIntegerv@8 _ilGetLumpPos@0 _ilGetPalBaseType@4 _ilGetPalette@0 _ilGetString@4 _ilGetTypeBpc@4 _ilHint@8 _ilImageToDxtcData@4 _ilInit@0 _ilInitImage@32 _ilInvertSurfaceDxtcDataAlpha@0 _ilIsDisabled@4 _ilIsEnabled@4 _ilIsImage@4 _ilIsValid@8 _ilIsValidF@8 _ilIsValidL@12 _ilIsValidPal@4 _ilKeyColour@16 _ilLoad@8 _ilLoadF@8 _ilLoadImage@4 _ilLoadL@12 _ilLoadPal@4 _ilModAlpha@8 _ilNewImage@20 _ilNewImageFull@28 _ilNextPower2@4 _ilOriginFunc@4 _ilOverlayImage@16 _ilPopAttrib@0 _ilPushAttrib@4 _ilRegisterFormat@4 _ilRegisterLoad@8 _ilRegisterMipNum@4 _ilRegisterNumFaces@4 _ilRegisterNumImages@4 _ilRegisterOrigin@4 _ilRegisterPal@12 _ilRegisterSave@8 _ilRegisterType@4 _ilRemoveLoad@4 _ilRemoveSave@4 _ilReplaceCurImage@4 _ilResetMemory@0 _ilResetRead@0 _ilResetWrite@0 _ilResizeImage@24 _ilSave@8 _ilSaveF@8 _ilSaveImage@4 _ilSaveL@12 _ilSavePal@4 _ilSetAlpha@8 _ilSetCurImage@4 _ilSetData@4 _ilSetDuration@4 _ilSetError@4 _ilSetInteger@8 _ilSetMemory@8 _ilSetPal@4 _ilSetPixels@36 _ilSetRead@28 _ilSetString@8 _ilSetWrite@24 _ilShutDown@0 _ilSurfaceToDxtcData@4 _ilTexImage@28 _ilTexImageDxtc@20 _ilTexImage_@32 _ilTexSubImage_@8 _ilTypeFromExt@4 _ilTypeFunc@4

generic

count=9, id=152, version=20115,

count=64, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=356, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=19, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=29, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=198, id=1, productName=Unmarked objects,

count=206, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,