2024-06-25_22a84f6f35853b8aca13c6b9967751dd_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-25_22a84f6f35853b8aca13c6b9967751dd_mafia
Size

480KB
MD5

22a84f6f35853b8aca13c6b9967751dd
SHA1

2c604d2c4c944ddacfc7c1196162ccfef29a9681
SHA256

72c78831444f8c9ce4ad1fefedd7e05749634a60e2db92d2e02f9e9f55357265
SHA512

e69d329cdf4f90dead96e70c2081abf791e3199658e50dc2b0c65c2e1e92d759ec605f6c66faa26f21dfb5abd1a64d7318b33184743858be5d792d59c98212c4
SSDEEP

12288:R/DeIQrOxXrBvz+T/o78F2iropvIGclRBzVwAzfcUo:5edrTUiro7clRBzVXz8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-25_22a84f6f35853b8aca13c6b9967751dd_mafia

Files

2024-06-25_22a84f6f35853b8aca13c6b9967751dd_mafia
.exe windows:5 windows x86 arch:x86

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
LoadLibraryExW
GlobalFree
GlobalHandle
CloseHandle
GetCurrentProcessId
CreateFileW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetCommandLineW
GetLocalTime
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryW
WriteFile
SetFilePointer
GetFileSize
InitializeCriticalSection
WideCharToMultiByte
lstrlenA
GetTickCount
VirtualProtect
WriteProcessMemory
CreateDirectoryW
Sleep
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
GetSystemTime
EnterCriticalSection
LeaveCriticalSection
LocalFree
FlushFileBuffers
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
GetLocaleInfoW
InterlockedExchange
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
HeapCreate
GetSystemTimeAsFileTime
ExitProcess
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SizeofResource
RaiseException
LockResource
LoadResource
FindResourceW
FindResourceExW
FlushInstructionCache
GetCurrentProcess
FreeLibrary
SetLastError
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetModuleHandleW
GetProcAddress
lstrlenW
GetCurrentThreadId
GlobalAlloc

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
UnregisterClassA
FindWindowExW
SetWindowLongW
DestroyWindow
DefWindowProcW
SetWindowPos
MoveWindow
GetWindowLongW
GetSysColor
PtInRect
OffsetRect
IntersectRect
UnionRect
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetParent
GetDlgItem
EnumChildWindows
SetActiveWindow
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
GetSystemMetrics
DestroyAcceleratorTable
SetFocus
GetWindow
GetFocus
SendMessageW
IsWindow
GetClassInfoExW
AnimateWindow
ShowWindow
BringWindowToTop
SetForegroundWindow
OpenClipboard
SystemParametersInfoW
EnableWindow
PostMessageW
SetTimer
KillTimer
EndDialog
SetWindowContextHelpId
MapDialogRect
PostQuitMessage
IsRectEmpty
SendDlgItemMessageW
SetWindowsHookExW
CallNextHookEx
GetAncestor
UnhookWindowsHookEx
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW

gdi32

GetObjectW
DeleteObject
GetStockObject
DeleteDC
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHGetFolderPathA
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitialize
CoUninitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
OleRun
CoGetClassObject
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
OleLockRunning
ProgIDFromCLSID
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

OleCreateFontIndirect
SysStringLen
VarBstrCmp
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantChangeType
VariantCopy
SysStringByteLen
SysAllocStringByteLen
DispCallFunc
GetErrorInfo
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
SysFreeString

urlmon

UrlMkSetSessionOption
CoInternetGetSession
ObtainUserAgentString

wininet

HttpAddRequestHeadersW
InternetOpenW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
InternetErrorDlg
InternetCanonicalizeUrlW
InternetCrackUrlW

dsound

ord1

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToDataEx

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

psapi

EnumProcessModules

winmm

PlaySoundA
waveOutWrite
midiStreamOut
PlaySoundW

wintrust

WinVerifyTrust

crypt32

CertOpenStore

Sections

.text
Size: 351KB - Virtual size: 351KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9cd9b043892f4998400b6b5d5ad1d0c7

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

wininet

dsound

dbghelp

version

psapi

winmm

wintrust

crypt32

Sections

.text Size: 351KB - Virtual size: 351KB

.rdata Size: 80KB - Virtual size: 80KB

.data Size: 12KB - Virtual size: 21KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 30KB - Virtual size: 32KB

.text
Size: 351KB - Virtual size: 351KB

.rdata
Size: 80KB - Virtual size: 80KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 30KB - Virtual size: 32KB