2024-02-02_2b73593ec518586384f34e4bbc957ebd_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-02_2b73593ec518586384f34e4bbc957ebd_mafia
Size

9.0MB
MD5

2b73593ec518586384f34e4bbc957ebd
SHA1

fbab2c6c223463f1ba6831e69d70e268e2de8abe
SHA256

5228f0926b4ab3cb79d277e7cc0af75a840fc476cfdac0612c0a9bd2a4a5d866
SHA512

691ab346ec089f7be016531a3fc7d45869e2348e7617c08edfcd0a05d4838263f4ea1941b49c4766c4824e78b46602c1513563970c19d7dd09248f16fdf2388a
SSDEEP

49152:lJxWfdFYXVVCjl5zkpclFddqFAv78xvoHn+K:lnWfQElOmFii

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-02_2b73593ec518586384f34e4bbc957ebd_mafia

Files

2024-02-02_2b73593ec518586384f34e4bbc957ebd_mafia
.exe windows:5 windows x86 arch:x86

059cd6fba0bea54c4f751f14b2b9331a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FormatMessageA
GetLastError
GetTickCount
SetEnvironmentVariableA
CompareStringW
CreateFileW
GetTimeZoneInformation
GetProcessHeap
SetEndOfFile
GetDriveTypeW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
HeapSize
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
RaiseException
RtlUnwind
HeapFree
GetCPInfo
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleW
ExitProcess
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
CreateDirectoryA
GetCommandLineA
HeapSetInformation
LCMapStringW
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
ReadFile
GetConsoleCP
GetConsoleMode
HeapCreate
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
FlushFileBuffers
SetFilePointer
CloseHandle
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
DeleteFileA

pdcurses

initscr
start_color
init_pair
endwin
clear
nodelay
getnstr
PDC_set_title
attrset
getcury
getcurx
attr_get
pair_content
mvgetstr
keypad
raw_output
echo
curs_set
noecho
addch
erase
refresh
stdscr
wgetch
move
addstr

Sections

.text
Size: 1019KB - Virtual size: 1018KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7.6MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

059cd6fba0bea54c4f751f14b2b9331a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

pdcurses

Sections

.text Size: 1019KB - Virtual size: 1018KB

.rdata Size: 259KB - Virtual size: 258KB

.data Size: 7.6MB - Virtual size: 8.0MB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 103KB - Virtual size: 103KB

.text
Size: 1019KB - Virtual size: 1018KB

.rdata
Size: 259KB - Virtual size: 258KB

.data
Size: 7.6MB - Virtual size: 8.0MB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 103KB - Virtual size: 103KB