Static task
static1
Behavioral task
behavioral1
Sample
2024-02-03_aa74dea65e12c44e3b99212d94c62887_laqma_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-03_aa74dea65e12c44e3b99212d94c62887_laqma_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-03_aa74dea65e12c44e3b99212d94c62887_laqma_mafia
-
Size
1.6MB
-
MD5
aa74dea65e12c44e3b99212d94c62887
-
SHA1
f1daba331ee6d18eb4aa8b5e914ded8eca4047c0
-
SHA256
51413eb6099076b7ee05c28a51c110e7c554d82951401dea6e5e979e9fa869f8
-
SHA512
6d93f747a663ae1ea100153842070bafd2264e6cd4830f863fbd060bcc8983de45452b97f1b8b94a5ce6b10012e2260bbab2b01337db5e9ce13a982360c4ae19
-
SSDEEP
24576:Mt6xkvQxZkIJhPjks37jIGeuEmXp2PnoAjlv/5Vs+Z6aZ:zkvCZksbsGJ2PljZI+Z6aZ
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule sample UPX -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-03_aa74dea65e12c44e3b99212d94c62887_laqma_mafia
Files
-
2024-02-03_aa74dea65e12c44e3b99212d94c62887_laqma_mafia.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 458KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 194.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ