2024-02-03_8b5646ec1c64f4510e3f6ae829cb0611_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-03_8b5646ec1c64f4510e3f6ae829cb0611_mafia
Size

1.6MB
MD5

8b5646ec1c64f4510e3f6ae829cb0611
SHA1

012993a7a724e1faf3f7463561aadecb357e37e0
SHA256

60ca91b5eb3c5155f54ea7d4f7950897e574a6e573734f585ae122ce475ed446
SHA512

52d9d6fac30ffdcc5efa5cf272b60cdd561afab3421deb7eb764f3c04e732f319445273b33dd20e2aa493bbfd0b5d6591503639b7f958f1fecbb9c22df71a73b
SSDEEP

24576:o0ykOwxniE6+vBSIIBH1Qe16OZH1AOXq4PjiH3cKVzhynQDAECW32JOt934J7Z6Z:pyExxoIidqvH3caIQDAE8JE3jM2ce

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_8b5646ec1c64f4510e3f6ae829cb0611_mafia

Files

2024-02-03_8b5646ec1c64f4510e3f6ae829cb0611_mafia
.exe windows:5 windows x86 arch:x86

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Desarrollo\TFS\Installers\Products\CloudAv\Release\Version 7.05.00.0047.x\Source\Code\Projects\Setup.exe\ProjectWin\bin\Release\Setup.pdb

Imports

gdiplus

GdiplusStartup
GdiplusShutdown

kernel32

SetFileAttributesW
SetLastError
GetUserDefaultLangID
GetVersionExW
lstrcmpiW
GetVersionExA
CreateProcessW
OpenProcess
GlobalMemoryStatus
GetDiskFreeSpaceW
GetTickCount
LocalAlloc
SetFilePointer
WriteFile
HeapSetInformation
HeapAlloc
HeapFree
GetProcessHeap
GetDateFormatW
OutputDebugStringW
GetTimeFormatW
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
WriteConsoleW
InterlockedExchange
QueryPerformanceCounter
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
GetDriveTypeW
WideCharToMultiByte
CreateFileW
ReadFile
MoveFileExW
LocalFree
FormatMessageA
LoadLibraryA
LoadLibraryW
CreateThread
SetEndOfFile
RemoveDirectoryW
CreateEventW
TerminateProcess
WaitForMultipleObjectsEx
LockResource
WritePrivateProfileStringW
SizeofResource
GetPrivateProfileStringW
LoadResource
FindResourceW
OpenEventW
CopyFileW
SetEvent
CreateDirectoryW
GetCurrentProcess
GetFullPathNameW
FileTimeToLocalFileTime
FindNextFileW
FindClose
FileTimeToSystemTime
FindFirstFileW
GetCommandLineW
DeleteFileW
GetTempPathW
GetTempFileNameW
GetPrivateProfileIntW
GetExitCodeProcess
GetModuleHandleW
CompareFileTime
ExpandEnvironmentStringsW
GetLocalTime
LoadLibraryExA
GetModuleFileNameA
Sleep
InterlockedCompareExchange
CreateMutexW
MultiByteToWideChar
CloseHandle
ReleaseMutex
GetLastError
OpenMutexW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetWindowsDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleExW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
EnumSystemLocalesA
SetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
HeapSize
RaiseException
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
IsValidLocale
CompareStringW
SetEnvironmentVariableW
GetCurrentThreadId
HeapCreate
IsProcessorFeaturePresent
GetFileType
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetStartupInfoW
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle

user32

GetDC
GetSystemMetrics
MessageBoxW
wsprintfW
ExitWindowsEx
MessageBoxA
ReleaseDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW
RegCloseKey
OpenProcessToken
FreeSid
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegEnumKeyExW
RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW

shell32

ord165

Sections

.text
Size: 769KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 616KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 769KB - Virtual size: 769KB

.rdata Size: 189KB - Virtual size: 188KB

.data Size: 13KB - Virtual size: 32KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 616KB - Virtual size: 620KB

.text
Size: 769KB - Virtual size: 769KB

.rdata
Size: 189KB - Virtual size: 188KB

.data
Size: 13KB - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 616KB - Virtual size: 620KB