2024-02-03_a9a5692b9a8a0942ec956c9009d9a0db_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-03_a9a5692b9a8a0942ec956c9009d9a0db_mafia
Size

1.6MB
MD5

a9a5692b9a8a0942ec956c9009d9a0db
SHA1

1a4b41bac1610d965438d2f6787367d905b44807
SHA256

6c16321b06446397d93d0db6da80ebee2b87ffd64b9e6e6a2eef9ce21925a4f0
SHA512

34202432fade59dc2bb84bad638712720ff5d9e38a2b74ae0c83f00fa18341226012251ad6f522d5421944f871f7d60e64244b586d94ee491c5d318b72c7410f
SSDEEP

24576:D0ykOwxniE6+vBSIIBH1Qe16OZH1AOXq4PjiH3cKVzhynQDAECW62JOt934J7Z6Z:YyExxoIidqvH3caIQDAEDJE3jM2ce

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_a9a5692b9a8a0942ec956c9009d9a0db_mafia

Files

2024-02-03_a9a5692b9a8a0942ec956c9009d9a0db_mafia
.exe windows:5 windows x86 arch:x86

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Desarrollo\TFS\Installers\Products\CloudAv\Release\Version 7.05.00.0047.x\Source\Code\Projects\Setup.exe\ProjectWin\bin\Release\Setup.pdb

Imports

gdiplus

GdiplusStartup
GdiplusShutdown

kernel32

SetFileAttributesW
SetLastError
GetUserDefaultLangID
GetVersionExW
lstrcmpiW
GetVersionExA
CreateProcessW
OpenProcess
GlobalMemoryStatus
GetDiskFreeSpaceW
GetTickCount
LocalAlloc
SetFilePointer
WriteFile
HeapSetInformation
HeapAlloc
HeapFree
GetProcessHeap
GetDateFormatW
OutputDebugStringW
GetTimeFormatW
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
WriteConsoleW
InterlockedExchange
QueryPerformanceCounter
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileAttributesW
GetDriveTypeW
WideCharToMultiByte
CreateFileW
ReadFile
MoveFileExW
LocalFree
FormatMessageA
LoadLibraryA
LoadLibraryW
CreateThread
SetEndOfFile
RemoveDirectoryW
CreateEventW
TerminateProcess
WaitForMultipleObjectsEx
LockResource
WritePrivateProfileStringW
SizeofResource
GetPrivateProfileStringW
LoadResource
FindResourceW
OpenEventW
CopyFileW
SetEvent
CreateDirectoryW
GetCurrentProcess
GetFullPathNameW
FileTimeToLocalFileTime
FindNextFileW
FindClose
FileTimeToSystemTime
FindFirstFileW
GetCommandLineW
DeleteFileW
GetTempPathW
GetTempFileNameW
GetPrivateProfileIntW
GetExitCodeProcess
GetModuleHandleW
CompareFileTime
ExpandEnvironmentStringsW
GetLocalTime
LoadLibraryExA
GetModuleFileNameA
Sleep
InterlockedCompareExchange
CreateMutexW
MultiByteToWideChar
CloseHandle
ReleaseMutex
GetLastError
OpenMutexW
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
GetWindowsDirectoryW
GetCurrentDirectoryW
GetCurrentProcessId
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleExW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
FreeLibrary
EnumSystemLocalesA
SetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetLocaleInfoW
HeapSize
RaiseException
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
IsValidLocale
CompareStringW
SetEnvironmentVariableW
GetCurrentThreadId
HeapCreate
IsProcessorFeaturePresent
GetFileType
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetStartupInfoW
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle

user32

GetDC
GetSystemMetrics
MessageBoxW
wsprintfW
ExitWindowsEx
MessageBoxA
ReleaseDC

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW
RegCloseKey
OpenProcessToken
FreeSid
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
GetTokenInformation
RegSetValueExW
RegEnumKeyExW
RegFlushKey
RegEnumValueW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW

shell32

ord165

Sections

.text
Size: 769KB - Virtual size: 769KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 616KB - Virtual size: 620KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

1b91924e9729d4c0fcea145b61f2c995

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

advapi32

shell32

Sections

.text Size: 769KB - Virtual size: 769KB

.rdata Size: 189KB - Virtual size: 188KB

.data Size: 13KB - Virtual size: 32KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 616KB - Virtual size: 620KB

.text
Size: 769KB - Virtual size: 769KB

.rdata
Size: 189KB - Virtual size: 188KB

.data
Size: 13KB - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 616KB - Virtual size: 620KB