2024-01-24_4db7eecead3c11f47c6ef6907a739c70_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-24_4db7eecead3c11f47c6ef6907a739c70_mafia
Size

361KB
MD5

4db7eecead3c11f47c6ef6907a739c70
SHA1

288c352c2b66454b87f61085ad998ce087e0377d
SHA256

7c008a61a002bbd909e91533ed132fafd626ca8f13f83483923d669e03c74325
SHA512

9f624c1541882056be9a99a4c907051525d0e7323595ec1e256476fb269b52fd60bc013297acde2e9b9e57968e8bc0bb3dcc15156b6dac3969dd1c639377d1ea
SSDEEP

6144:gTDKVc8bVxmnbr4SXMJUeRPhID9SiFRPqx0jXt:gTD6LBwbr40MJUeRPhID9vFRPyKt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-01-24_4db7eecead3c11f47c6ef6907a739c70_mafia

Files

2024-01-24_4db7eecead3c11f47c6ef6907a739c70_mafia
.exe windows:5 windows x86 arch:x86

ddabc353dcd852cc73d5a7451f0282e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetSystemDirectoryA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetEnvironmentVariableA
CopyFileA
GetProcAddress
GetModuleHandleA
SearchPathA
CreateActCtxA
FreeLibrary
EnumResourceNamesA
LoadLibraryExA
ReleaseActCtx
DeactivateActCtx
WideCharToMultiByte
QueryActCtxW
ActivateActCtx
GetComputerNameA
GetModuleFileNameA
Wow64RevertWow64FsRedirection
GetLastError
Wow64DisableWow64FsRedirection
GetUserPreferredUILanguages
CopyFileW
CreateDirectoryW
MultiByteToWideChar
LoadLibraryA
SetErrorMode
GetFileSize
VirtualAlloc
SetLastError
VirtualQuery
VirtualFree
GetCurrentProcess
ReadFile
WriteFile
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
Sleep
FormatMessageA
GetFullPathNameA
LocalFree
lstrcpyA
LocalAlloc
lstrcatA
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
WriteConsoleW
GetStdHandle
GetModuleFileNameW
GetFileAttributesA
lstrcmpiA
CreateDirectoryA
GetCurrentProcessId
MoveFileA
SetFileAttributesA
GetDriveTypeA
FindFirstFileExA
DuplicateHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FatalAppExitA
EncodePointer
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
RtlUnwind
GetStringTypeW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
SetEndOfFile
CreateFileW
CreateFileA
CloseHandle
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
IsBadReadPtr
FindFirstFileA
FindNextFileA
DeleteFileA
FindClose

user32

MessageBoxA

advapi32

RegDeleteKeyA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

CoverageAddAnnotation
CoverageClearData
CoverageDisableRecordingData
CoverageIsRecordingData
CoverageIsRunning
CoverageSaveData
CoverageStartRecordingData
CoverageStopRecordingData
PurePrintf
PurifyAllHandlesInuse
PurifyAllInuse
PurifyAllLeaks
PurifyAssertIsReadable
PurifyAssertIsWritable
PurifyBlue
PurifyClearInuse
PurifyClearLeaks
PurifyDescribe
PurifyGetPoolId
PurifyGetUserData
PurifyGreen
PurifyHeapValidate
PurifyIsInitialized
PurifyIsReadable
PurifyIsRunning
PurifyIsWritable
PurifyMapPool
PurifyMarkAsInitialized
PurifyMarkAsUninitialized
PurifyMarkForNoTrap
PurifyMarkForTrap
PurifyNewHandlesInuse
PurifyNewInuse
PurifyNewLeaks
PurifyPostAlloc
PurifyPostDidAlloc
PurifyPostFree
PurifyPostGetSize
PurifyPostHeapMinimize
PurifyPostRealloc
PurifyPreAlloc
PurifyPreDidAlloc
PurifyPreFree
PurifyPreGetSize
PurifyPreHeapMinimize
PurifyPreRealloc
PurifyPrintf
PurifyRed
PurifySetLateDetectScanCounter
PurifySetLateDetectScanInterval
PurifySetPoolId
PurifySetUserData
PurifyWhatColors
PurifyYellow
QuantifyAddAnnotation
QuantifyClearData
QuantifyDisableRecordingData
QuantifyIsRecordingData
QuantifyIsRunning
QuantifySaveData
QuantifySetThreadName
QuantifyStartRecordingData
QuantifyStopRecordingData
StartPureRTDebugLogging
StopPureRTDebugLogging

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ddabc353dcd852cc73d5a7451f0282e3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

version

Exports

Exports

Sections

.text Size: 262KB - Virtual size: 262KB

.rdata Size: 58KB - Virtual size: 57KB

.data Size: 24KB - Virtual size: 121KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 14KB - Virtual size: 13KB

.text
Size: 262KB - Virtual size: 262KB

.rdata
Size: 58KB - Virtual size: 57KB

.data
Size: 24KB - Virtual size: 121KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 14KB - Virtual size: 13KB