2024-02-03_43fc5831559553ebec10ecf43e1586a1_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-03_43fc5831559553ebec10ecf43e1586a1_mafia
Size

1.6MB
MD5

43fc5831559553ebec10ecf43e1586a1
SHA1

070c53dbd8a0db0badae13d4b67e37445dc35a91
SHA256

a1cec9070f67124ac94c9ed7ac0d268d2775c6fd1bf5e773b852b1f9e65cda68
SHA512

014280f97fcc014f235a5264848afb6a2c05c272a67086eb8f347d291ee305185aa689bc6ff54e748537f0477e7540e611193f451715904b0aa5061c4ed2ecf3
SSDEEP

24576:H0ykOwxniE6+vBSIIBH1Qe16OZH1AOXq4PjiH3cKVzhynQDAECW32JOt934J7Z6Z:UyExxoIidqvH3caIQDAE8JE3jM2ce

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_43fc5831559553ebec10ecf43e1586a1_mafia

Files

2024-02-03_43fc5831559553ebec10ecf43e1586a1_mafia
.exe windows:5 windows x86 arch:x86

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Desarrollo\TFS\Installers\Products\CloudAv\Release\Version 7.05.00.0047.x\Source\Code\Projects\Setup.exe\ProjectWin\bin\Release\Setup.pdb

Imports

gdiplus

GdiplusStartup
GdiplusShutdown

kernel32

SetFileAttributesW
SetLastError
GetUserDefaultLangID
GetVersionExW
lstrcmpiW
GetVersionExA
CreateProcessW
OpenProcess
GlobalMemoryStatus
GetDiskFreeSpaceW
GetTickCount
LocalAlloc
SetFilePointer
WriteFile
HeapSetInformation
HeapAlloc
HeapFree
GetProcessHeap
GetDateFormatW
OutputDebugStringW
GetTimeFormatW
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
WriteConsoleW
InterlockedExchange
QueryPerformanceCounter
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
GetDriveTypeW
WideCharToMultiByte
CreateFileW
ReadFile
MoveFileExW
LocalFree
FormatMessageA
LoadLibraryA
LoadLibraryW
CreateThread
SetEndOfFile
RemoveDirectoryW
CreateEventW
TerminateProcess
WaitForMultipleObjectsEx
LockResource
WritePrivateProfileStringW
SizeofResource
GetPrivateProfileStringW
LoadResource
FindResourceW
OpenEventW
CopyFileW
SetEvent
CreateDirectoryW
GetCurrentProcess
GetFullPathNameW
FileTimeToLocalFileTime
FindNextFileW
FindClose
FileTimeToSystemTime
FindFirstFileW
GetCommandLineW
DeleteFileW
GetTempPathW
GetTempFileNameW
GetPrivateProfileIntW
GetExitCodeProcess
GetModuleHandleW
CompareFileTime
ExpandEnvironmentStringsW
GetLocalTime
LoadLibraryExA
GetModuleFileNameA
Sleep
InterlockedCompareExchange
CreateMutexW
MultiByteToWideChar
CloseHandle
ReleaseMutex
GetLastError
OpenMutexW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetWindowsDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleExW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
EnumSystemLocalesA
SetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
HeapSize
RaiseException
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
IsValidLocale
CompareStringW
SetEnvironmentVariableW
GetCurrentThreadId
HeapCreate
IsProcessorFeaturePresent
GetFileType
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetStartupInfoW
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle

user32

GetDC
GetSystemMetrics
MessageBoxW
wsprintfW
ExitWindowsEx
MessageBoxA
ReleaseDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW
RegCloseKey
OpenProcessToken
FreeSid
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegEnumKeyExW
RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW

shell32

ord165

Sections

.text
Size: 769KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 616KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 769KB - Virtual size: 769KB

.rdata Size: 189KB - Virtual size: 188KB

.data Size: 13KB - Virtual size: 32KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 616KB - Virtual size: 620KB

.text
Size: 769KB - Virtual size: 769KB

.rdata
Size: 189KB - Virtual size: 188KB

.data
Size: 13KB - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 616KB - Virtual size: 620KB