2024-07-09_59d44e43698c227f684927dab2e62aa3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-09_59d44e43698c227f684927dab2e62aa3_mafia
Size

10.4MB
MD5

59d44e43698c227f684927dab2e62aa3
SHA1

15f1db949681123ce14e4d76f816e22d7dfe1bf2
SHA256

135bcf89f518256de86bc4eeb17d30cf1b37c781c8899d45d3faf48a6e0a5c3b
SHA512

9f70ee6ff31e4f5092ac502531bdccf79ee70d93d3ffe33d4a30ca642de17ce44b4800056d78a5671f323f35c7bd42cd8b0fa8f22e6f457ee3319f334e298e7f
SSDEEP

196608:J/KSRZInjcmpM41E7dJPGk6QqKk3h8oPAEJVg0dcEVY:J/KSR6nvS46bP1qKE8cQ6cEV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-09_59d44e43698c227f684927dab2e62aa3_mafia

Files

2024-07-09_59d44e43698c227f684927dab2e62aa3_mafia
.exe windows:5 windows x86 arch:x86

8141e9c8ca7d95b625525941322fe69a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\source\pvpWar81\Client\Game\output\Release_ME\SFrame.pdb

Imports

kernel32

TerminateProcess
ReadConsoleInputA
FindFirstFileExA
GetCurrentDirectoryW
GetSystemInfo
GetEnvironmentVariableA
GetACP
LoadLibraryExA
SetLastError
lstrcmpA
FlushInstructionCache
IsDBCSLeadByte
SetConsoleMode
GetCurrentProcessId
CreateProcessA
lstrcmpiA
GetModuleHandleA
InterlockedPopEntrySList
InterlockedPushEntrySList
CreateToolhelp32Snapshot
Process32Next
OpenProcess
Process32First
LocalAlloc
RemoveDirectoryA
FormatMessageA
DebugBreak
FlushConsoleInputBuffer
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
FindFirstFileA
SetConsoleCtrlHandler
FlushFileBuffers
WriteConsoleW
SetHandleCount
GetFileType
HeapCreate
GetLocaleInfoW
IsDebuggerPresent
UnhandledExceptionFilter
IsValidCodePage
GetOEMCP
FileTimeToSystemTime
lstrlenW
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
ExitThread
HeapReAlloc
GetModuleHandleW
GetConsoleMode
GetConsoleCP
RtlUnwind
DecodePointer
EncodePointer
GetStringTypeW
PeekNamedPipe
GetStdHandle
SetStdHandle
GetFileInformationByHandle
VirtualQuery
GetModuleFileNameW
IsBadReadPtr
VirtualProtect
ExitProcess
GetComputerNameA
TerminateThread
CreateThread
CopyFileA
SetUnhandledExceptionFilter
HeapFree
GetProcessHeap
HeapAlloc
SetEndOfFile
VirtualAlloc
VirtualFree
SetFilePointer
GetFullPathNameA
InterlockedCompareExchange
InterlockedExchange
UnmapViewOfFile
CreateFileW
CreateFileMappingA
MapViewOfFile
IsProcessorFeaturePresent
GetTempPathA
GetTempFileNameA
LocalFree
GetCurrentProcess
lstrcpyA
InitializeCriticalSectionAndSpinCount
RaiseException
GetVersionExA
GetLocaleInfoA
CompareStringA
GlobalAlloc
FileTimeToLocalFileTime
GetDriveTypeA
HeapSize
FindNextFileA
FindClose
LoadLibraryA
GetProcAddress
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
OutputDebugStringA
InitializeCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
GetFileAttributesA
SetFileAttributesA
lstrlenA
MultiByteToWideChar
GetLastError
GetLocalTime
InterlockedDecrement
InterlockedIncrement
CreateFileA
GetFileSize
CloseHandle
ReadFile
GlobalLock
GlobalUnlock
MulDiv
CreateMutexA
OpenMutexA
WaitForSingleObject
ReleaseMutex
GetTickCount
GetSystemDirectoryA
GetSystemDefaultLangID
GlobalMemoryStatus
WritePrivateProfileStringA
GetCurrentDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
lstrcatA
GetVersion
GetCurrentThread
SetThreadPriority
WaitForMultipleObjects
SetEvent
CreateEventA
IsBadWritePtr
GetCurrentThreadId
WideCharToMultiByte
CreateDirectoryA
FindResourceA
SizeofResource
LoadResource
WriteFile
LockResource
TlsFree
GetExitCodeProcess
LoadLibraryW
GetDriveTypeW

ws2_32

__WSAFDIsSet
recv
send
WSAStartup
htons
inet_addr
gethostbyname
socket
closesocket
connect
select
WSACleanup
sendto

imm32

ImmGetIMEFileNameA
ImmGetOpenStatus
ImmIsIME
ImmGetProperty
ImmSetConversionStatus
ImmGetCandidateListW
ImmGetVirtualKey
ImmReleaseContext
ImmNotifyIME
ImmGetCompositionStringW
ImmGetContext
ImmGetConversionStatus

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetModuleFileNameExA

d3d9

Direct3DCreate9

devil

ilGenImages
ilGetError
ilBindImage
ilLoadImage
ilTexImage
ilGetData
ilSaveImage
ilDeleteImages
ilInit
ilEnable
ilSave
ilSetInteger
ilOriginFunc

ilu

iluFlipImage
iluErrorString

libgobject-2.0-0

g_object_ref
g_object_unref

libcairo-2

cairo_surface_destroy
cairo_image_surface_create
cairo_font_options_destroy
cairo_font_options_set_antialias
cairo_font_options_create
cairo_destroy
cairo_surface_write_to_png
cairo_move_to
cairo_set_source_rgba
cairo_paint
cairo_image_surface_get_stride
cairo_image_surface_get_data
cairo_create

libpango-1.0-0

pango_layout_set_indent
pango_layout_set_justify
pango_font_description_free
pango_layout_set_height
pango_layout_set_width
pango_layout_new
pango_layout_set_text
pango_layout_set_font_description
pango_font_description_set_weight
pango_font_description_from_string
pango_attr_list_unref
pango_layout_set_spacing
pango_layout_get_pixel_size
pango_layout_get_line_readonly
pango_layout_get_line_count
pango_context_set_base_dir
pango_layout_set_auto_dir
pango_layout_get_pixel_extents
pango_attr_underline_new
pango_attr_strikethrough_new
pango_attr_weight_new
pango_attr_background_new
pango_attr_foreground_new
pango_attr_size_new
pango_layout_set_wrap
pango_layout_context_changed
pango_layout_set_attributes
pango_font_map_create_context
pango_attr_list_insert
pango_attr_family_new
pango_attr_list_new
pango_layout_set_alignment

libpangocairo-1.0-0

pango_cairo_update_context
pango_cairo_show_layout
pango_cairo_font_map_new_for_font_type
pango_cairo_context_set_font_options
pango_cairo_font_map_get_default

user32

InvalidateRgn
IsChild
GetParent
GetDlgItem
GetFocus
GetClassNameA
GetProcessWindowStation
GetUserObjectInformationW
FillRect
EndPaint
BeginPaint
DestroyAcceleratorTable
GetKeyState
wsprintfA
MessageBoxA
SetRect
GetDesktopWindow
IsWindow
GetClassInfoExA
LoadCursorA
CreateAcceleratorTableA
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
SetParent
GetWindowTextA
GetWindowTextLengthA
RegisterWindowMessageA
LoadAcceleratorsA
LoadStringA
GetWindow
ShowWindow
GetDC
PostMessageA
SetFocus
InvalidateRect
ReleaseDC
MoveWindow
SetWindowTextA
EnableWindow
CallWindowProcA
CharNextExA
SetWindowLongA
GetKeyboardLayout
CreateWindowExA
SendMessageA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
RedrawWindow
BringWindowToTop
GetClientRect
GetAsyncKeyState
GetSysColor
AdjustWindowRect
UpdateWindow
SetWindowTextW
LoadIconA
RegisterClassExA
CharNextA
DefWindowProcA
DestroyWindow
ClientToScreen
ReleaseCapture
SetCapture
PostQuitMessage
ShowCursor
GetSystemMetrics
SetCursor
SetWindowPos
ScreenToClient
CloseClipboard
GetClipboardData
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
EmptyClipboard
GetWindowLongA
UnregisterClassA
GetWindowRect

gdi32

CreateCompatibleBitmap
DeleteDC
GetStockObject
SelectObject
CreateCompatibleDC
CreateFontA
DeleteObject
EnumFontFamiliesExA
BitBlt
CreateSolidBrush
GetObjectA
GetDeviceCaps

comdlg32

GetOpenFileNameA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyW
RegEnumKeyExA
RegOpenKeyA
CryptReleaseContext
CryptDestroyKey
GetUserNameA
RegEnumValueA
CryptDestroyHash
RegCloseKey
DeregisterEventSource
ReportEventA
RegisterEventSourceA

shell32

ShellExecuteA

ole32

OleLockRunning
CoGetClassObject
CLSIDFromProgID
CoInitialize
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CLSIDFromString
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
StringFromGUID2

oleaut32

LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarUI4FromStr
SysAllocString
SysAllocStringLen
SysFreeString
VariantCopy
VariantInit
VariantClear
SysStringLen

iphlpapi

GetIfTable
GetAdaptersInfo

dbghelp

SymSetOptions
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymInitialize
SymFromAddr

wintrust

WinVerifyTrust

crypt32

CryptMsgClose
CertGetNameStringW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptQueryObject

wininet

InternetOpenUrlA
HttpQueryInfoA
InternetOpenA
HttpOpenRequestA
HttpSendRequestA
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle
InternetConnectA

audiere

_AdrOpenSound@12
_AdrOpenSampleSourceFromFile@8
_AdrGetSampleSize@4

mss32

_AIL_set_digital_master_volume_level@8
_AIL_set_file_callbacks@16
_AIL_register_stream_callback@8
_AIL_set_room_type@8
_AIL_set_redist_directory@4
_AIL_set_DirectSound_HWND@8
_AIL_release_sample_handle@4
_AIL_set_sample_3D_position@16
_AIL_set_sample_volume_levels@12
_AIL_set_sample_processor@12
_AIL_close_digital_driver@4
_AIL_stream_status@4
_AIL_enumerate_filters@12
_AIL_open_stream@12
_AIL_set_listener_3D_orientation@28
_AIL_stream_sample_handle@4
_AIL_set_sample_3D_distances@16
_AIL_start_stream@4
_AIL_set_stream_loop_count@8
_AIL_set_sample_low_pass_cut_off@8
_AIL_set_sample_playback_rate@8
_AIL_set_sample_loop_count@8
_AIL_file_read@8
_AIL_stop_sample@4
_AIL_allocate_sample_handle@4
_AIL_set_sample_reverb_levels@12
_AIL_shutdown@0
_AIL_close_stream@4
_AIL_room_type@4
_AIL_sample_stage_property@24
_AIL_sample_status@4
_AIL_open_digital_driver@16
_AIL_startup@0
_AIL_set_named_sample_file@20
_AIL_pause_stream@8
_AIL_start_sample@4
_AIL_mem_free_lock@4
_AIL_set_listener_3D_position@16

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 230KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 633B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 695KB - Virtual size: 694KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 502KB - Virtual size: 501KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8141e9c8ca7d95b625525941322fe69a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

imm32

version

psapi

d3d9

devil

ilu

libgobject-2.0-0

libcairo-2

libpango-1.0-0

libpangocairo-1.0-0

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

dbghelp

wintrust

crypt32

wininet

audiere

mss32

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rodata Size: 11KB - Virtual size: 10KB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 230KB - Virtual size: 559KB

.tls Size: 1024B - Virtual size: 633B

.rsrc Size: 695KB - Virtual size: 694KB

.reloc Size: 502KB - Virtual size: 501KB

.text
Size: 6.8MB - Virtual size: 6.8MB

.rodata
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 230KB - Virtual size: 559KB

.tls
Size: 1024B - Virtual size: 633B

.rsrc
Size: 695KB - Virtual size: 694KB

.reloc
Size: 502KB - Virtual size: 501KB