2024-06-12_01b6fa3cd6958e1c7935512a960b2086_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-12_01b6fa3cd6958e1c7935512a960b2086_mafia
Size 2.5MB
Sample240612-b49gxayanl
SHA256 68170742588ec8be60c568c4f5b40175170dfbd6e8284188e1eb5d7218ee8df0
MD5 01b6fa3cd6958e1c7935512a960b2086
SHA1 1ea228adbe3a98ed3e2216aa4d17585f78aee1fd
SHA512 047b8e56c72932a34baf601af8d102fae33738c77e16e3e04d31fa2911e35394d51d014e76cff641dd1025e402ec4e70555d684e6dc5d8c48044d6cd81699ee9
SSDEEP 49152:LfEIIs7mpMDVaiADHjoYM3C9sPZowhxPR+TyLcq347gBN:TEI0pMDVaiQHsfS9+ZjZLW7i
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_01b6fa3cd6958e1c7935512a960b2086_mafia

File Explorer

2024-06-12_01b6fa3cd6958e1c7935512a960b2086_mafia

.exe 2.5MB

2024-06-12_01b6fa3cd6958e1c7935512a960b2086_mafia

IMPHASH 8042b7649759bf6732b280ef8142f9db
SHA256 68170742588ec8be60c568c4f5b40175170dfbd6e8284188e1eb5d7218ee8df0
MD5 01b6fa3cd6958e1c7935512a960b2086
SHA1 1ea228adbe3a98ed3e2216aa4d17585f78aee1fd
SHA512 047b8e56c72932a34baf601af8d102fae33738c77e16e3e04d31fa2911e35394d51d014e76cff641dd1025e402ec4e70555d684e6dc5d8c48044d6cd81699ee9
SSDEEP 49152:LfEIIs7mpMDVaiADHjoYM3C9sPZowhxPR+TyLcq347gBN:TEI0pMDVaiQHsfS9+ZjZLW7i
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632887

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize CreateFileW QueryPerformanceCounter QueryPerformanceFrequency GetProcAddress LoadLibraryW GetCurrentProcess GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement Sleep InterlockedExchange DeleteCriticalSection EncodePointer DecodePointer RaiseException RtlUnwind GetCommandLineA HeapSetInformation GetStartupInfoW HeapFree HeapAlloc GetSystemTimeAsFileTime LCMapStringW GetCPInfo IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess UnhandledExceptionFilter CloseHandle IsDebuggerPresent HeapSize ExitProcess GetStdHandle GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteFile SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType HeapCreate GetTickCount GetTimeZoneInformation GetConsoleCP GetConsoleMode FlushFileBuffers GetStringTypeW HeapReAlloc GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileA WriteConsoleW SetEndOfFile GetProcessHeap CompareStringW SetEnvironmentVariableA SetFilePointer OutputDebugStringW GetCommandLineW SetUnhandledExceptionFilter ReadFile SetCurrentDirectoryW lstrlenA OutputDebugStringA VirtualAlloc VirtualFree GetSystemInfo UnmapViewOfFile GetVersionExA CreateFileMappingA MapViewOfFile LoadLibraryA lstrcmpiA GetFullPathNameA InterlockedCompareExchange GetDateFormatA GetTimeFormatA GetSystemTime LocalFree GetCurrentThreadId GetModuleHandleA SetLastError GetModuleHandleW GetModuleFileNameW GetLastError CreateThread SetThreadPriority FindNextFileW FindFirstFileW FindClose CreateDirectoryW DeleteFileW GetEnvironmentStringsW

user32

CharToOemBuffW OemToCharBuffW PeekMessageW TranslateMessage FindWindowW LoadAcceleratorsA LoadIconA DispatchMessageW LoadCursorA RegisterClassExW GetWindowLongW GetKeyboardState ToUnicode GetMonitorInfoA EnumDisplayMonitors UpdateWindow ShowWindow SetWindowLongW CreateWindowExW SetForegroundWindow SetWindowPos ReleaseCapture AdjustWindowRect DestroyWindow DefWindowProcW GetWindowPlacement EndPaint BeginPaint

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoInitialize CoUninitialize

magic

Magic_IsInterval1 Magic_SetEmitterPosition Magic_SetEmitterPositionMode Magic_Restart Magic_IsInterrupt Magic_SetInterrupt Magic_Stop Magic_InInterval Magic_EmitterToInterval1 Magic_OpenFileInMemory Magic_GetStaticAtlas Magic_SetCurrentFolder Magic_FindFirst Magic_FindNext Magic_LoadEmitter Magic_GetFileName Magic_HasTextures Magic_SetInterpolationMode Magic_SetLoopMode Magic_GetStaticAtlasCount Magic_CreateFirstRenderedParticlesList Magic_GetNextParticleVertexes Magic_CreateNextRenderedParticlesList Magic_SetEmitterDirection Magic_Update Magic_GetUpdateTime Magic_IsInterpolationMode Magic_GetEmitterPosition Magic_DuplicateEmitter

bass

BASS_ChannelPlay BASS_ChannelRemoveSync BASS_ChannelSetSync BASS_ChannelSlideAttribute BASS_Start BASS_SampleGetChannel BASS_ChannelStop BASS_Init BASS_StreamFree BASS_StreamCreateFileUser BASS_SampleLoad BASS_Pause BASS_ChannelSetAttribute BASS_SampleFree BASS_ChannelIsActive

shlwapi

StrCpyW

d3d9

Direct3DCreate9

gdi32

DeleteObject

_iBindImageTemp@0 _iConvertImage@12 _iConvertPal@8 _iCopyPal@0 _iFlipBuffer@16 _iGetFlipped@4 _iGetIntegervImage@12 _iMemSwap@12 _iMirror@0 _ialloc@4 _icalloc@8 _ifree@4 _ilActiveFace@4 _ilActiveImage@4 _ilActiveLayer@4 _ilActiveMipmap@4 _ilApplyPal@4 _ilBindImage@4 _ilBlit@40 _ilClampNTSC@0 _ilClearColour@16 _ilClearImage@0 _ilClearImage_@4 _ilCloneCurImage@0 _ilCloseImage@4 _ilClosePal@4 _ilCompressDXT@24 _ilCompressFunc@4 _ilConvertBuffer@28 _ilConvertImage@8 _ilConvertPal@4 _ilCopyImage@4 _ilCopyImageAttr@8 _ilCopyImage_@4 _ilCopyPixels@36 _ilCreateSubImage@8 _ilDefaultImage@0 _ilDeleteImage@4 _ilDeleteImages@8 _ilDetermineType@4 _ilDetermineTypeF@4 _ilDetermineTypeL@8 _ilDisable@4 _ilDxtcDataToImage@0 _ilDxtcDataToSurface@0 _ilEnable@4 _ilFlipSurfaceDxtcData@0 _ilFormatFunc@4 _ilGenImage@0 _ilGenImages@8 _ilGetAlpha@4 _ilGetBoolean@4 _ilGetBooleanv@8 _ilGetBpcType@4 _ilGetBppFormat@4 _ilGetBppPal@4 _ilGetClear@12 _ilGetCurImage@0 _ilGetCurName@0 _ilGetDXTCData@12 _ilGetData@0 _ilGetError@0 _ilGetFormatBpp@4 _ilGetInteger@4 _ilGetIntegerv@8 _ilGetLumpPos@0 _ilGetPalBaseType@4 _ilGetPalette@0 _ilGetString@4 _ilGetTypeBpc@4 _ilHint@8 _ilImageToDxtcData@4 _ilInit@0 _ilInitImage@32 _ilInvertSurfaceDxtcDataAlpha@0 _ilIsDisabled@4 _ilIsEnabled@4 _ilIsImage@4 _ilIsValid@8 _ilIsValidF@8 _ilIsValidL@12 _ilIsValidPal@4 _ilKeyColour@16 _ilLoad@8 _ilLoadF@8 _ilLoadImage@4 _ilLoadL@12 _ilLoadPal@4 _ilModAlpha@8 _ilNewImage@20 _ilNewImageFull@28 _ilNextPower2@4 _ilOriginFunc@4 _ilOverlayImage@16 _ilPopAttrib@0 _ilPushAttrib@4 _ilRegisterFormat@4 _ilRegisterLoad@8 _ilRegisterMipNum@4 _ilRegisterNumFaces@4 _ilRegisterNumImages@4 _ilRegisterOrigin@4 _ilRegisterPal@12 _ilRegisterSave@8 _ilRegisterType@4 _ilRemoveLoad@4 _ilRemoveSave@4 _ilReplaceCurImage@4 _ilResetMemory@0 _ilResetRead@0 _ilResetWrite@0 _ilResizeImage@24 _ilSave@8 _ilSaveF@8 _ilSaveImage@4 _ilSaveL@12 _ilSavePal@4 _ilSetAlpha@8 _ilSetCurImage@4 _ilSetData@4 _ilSetDuration@4 _ilSetError@4 _ilSetInteger@8 _ilSetMemory@8 _ilSetPal@4 _ilSetPixels@36 _ilSetRead@28 _ilSetString@8 _ilSetWrite@24 _ilShutDown@0 _ilSurfaceToDxtcData@4 _ilTexImage@28 _ilTexImageDxtc@20 _ilTexImage_@32 _ilTexSubImage_@8 _ilTypeFromExt@4 _ilTypeFunc@4

generic

count=9, id=152, version=20115,

count=64, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=356, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=19, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=29, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=17, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=198, id=1, productName=Unmarked objects,

count=206, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,