Static task
static1
Behavioral task
behavioral1
Sample
20240106a1fb357d95efdb063f9b433fc1f6ac6bkaraganymafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20240106a1fb357d95efdb063f9b433fc1f6ac6bkaraganymafia.exe
Resource
win10v2004-20231222-en
General
-
Target
20240106a1fb357d95efdb063f9b433fc1f6ac6bkaraganymafia.exe
-
Size
255KB
-
MD5
a1fb357d95efdb063f9b433fc1f6ac6b
-
SHA1
8295a50d7dbc3e7f18230f42a7b056520b880228
-
SHA256
397b636502d8c6c9d191905df8c9c4e6cc21414859b05bf087b96ce7fc6e94b5
-
SHA512
d64dec92deea79660f2a5d04b58bee684b27be6d55e2f6cc5a3809113ded09876e6006c366d3016a5b7e4c3a7507f04d54e9063380319f4a245aed8b38883643
-
SSDEEP
3072:6yR64m3uiNEib+3NlcpX0XEtnvJzfQcHa8fiLtPy0AV5ODgnVqTLA4OmsWF:5H6Gh3vK0XEtJDHhfyylODgnMo4nsM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20240106a1fb357d95efdb063f9b433fc1f6ac6bkaraganymafia.exe
Files
-
20240106a1fb357d95efdb063f9b433fc1f6ac6bkaraganymafia.exe.exe windows:5 windows x86 arch:x86
56544831523e9e8f64e42a4d6aeb1ade
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
FindActCtxSectionStringW
SetVolumeMountPointA
GetProcAddress
LoadLibraryW
GetQueuedCompletionStatus
GlobalDeleteAtom
GetCPInfoExA
lstrlenA
ReadFile
GetProcessHeap
SetEndOfFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLastError
HeapFree
RtlUnwind
RaiseException
GetCommandLineW
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
CloseHandle
CreateFileA
CreateFileW
user32
GetCaretPos
DdeClientTransaction
GetPropW
ole32
CoGetCurrentProcess
Sections
.text Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ