mafiaware666 | WindowsFormsApp1[.]exe | Triage

Sharing

General

Target

WindowsFormsApp1.exe
Size

14.5MB
MD5

6c8868a84d7667ba67ba4458fa5acaac
SHA1

1fd296e86f968d3b183d0caaaa5bcd79c95d9d1f
SHA256

63f36d2eaa948f4e8625febe0ce7ae00b309dcb14572f3436dd259411a805808
SHA512

f081767ec38815f51e5d55e722d8389e442991d91e2792221b793e2170c30f976dc53ac0142b277beb7ccad2e342e313e48003a478f6720d4681ff7cfb6e047a
SSDEEP

196608:mz+BXp17ELB4ruPT6RbzNde8kfhifUG2hqSFMMAjqSFMMA:C2D88STIbzzzkfhiJ6JQJ

Score

10^/10

mafiaware666

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

Processes:

resource yara_rule

sample family_mafiaware666
Mafiaware666 family
mafiaware666

Files

WindowsFormsApp1.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.4MB - Virtual size: 14.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ