2024-02-03_b028a38d8496a5c9b10c512855bc900c_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-03_b028a38d8496a5c9b10c512855bc900c_mafia
Size

5.4MB
MD5

b028a38d8496a5c9b10c512855bc900c
SHA1

54a0273abb6969cb761e831bd2fd75ebfe205604
SHA256

63c40dec43642103359ad41685b7ce48c1f2d488ebffcf050a2d2068ca9ee4bb
SHA512

93af037c14cd7dae765cd3d8d69b8cc7924356871aae54c6d6853421a2e08f58702df1c8208dc529c0d54cf374403441325661df836c3bd77a9eb38139bce0f2
SSDEEP

49152:gcqHJ7elHHGt0UaYJFYv9Hm8DEpwUvqwVgcWJpeSj5r17kHuCAbj++Q56XI3TOOP:jWMlHmt0U/MMn2P3272D/yABIn2n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-03_b028a38d8496a5c9b10c512855bc900c_mafia

Files

2024-02-03_b028a38d8496a5c9b10c512855bc900c_mafia
.exe windows:5 windows x86 arch:x86

a3366ab34fa8ef110ee311776cfea24e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Cristy\ImageMagick-6.7.9\VisualMagick\bin\convert.pdb

Imports

vcomp100

_vcomp_barrier
_vcomp_single_end
_vcomp_master_end
_vcomp_enter_critsect
_vcomp_leave_critsect
omp_get_thread_num
omp_get_max_threads
_vcomp_for_static_simple_init
_vcomp_fork
_vcomp_set_num_threads
_vcomp_for_static_init
_vcomp_single_begin
omp_set_num_threads
omp_set_nested
_vcomp_for_static_end
_vcomp_master_begin

kernel32

WideCharToMultiByte
FindClose
FreeLibrary
SetConsoleCtrlHandler
SystemTimeToFileTime
GetSystemTime
GetModuleFileNameA
LocalFree
FormatMessageA
GetLastError
GetProcAddress
GetModuleHandleA
IsWow64Process
GetCurrentProcess
CloseHandle
MapViewOfFile
CreateFileMappingA
FindFirstFileA
LoadLibraryExA
SetErrorMode
FindNextFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
FlushViewOfFile
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GlobalMemoryStatus
GetSystemInfo
SetEndOfFile
SetFilePointer
UnmapViewOfFile
GetProcessTimes
TerminateProcess
GetCurrentThreadId
OutputDebugStringA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLogicalDrives
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCommandLineW
HeapSetInformation
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
GetFileType
CreateFileW
GetCurrentDirectoryA
GetTimeZoneInformation
SetStdHandle
GetCurrentProcessId
FileTimeToSystemTime
GetVersionExA
GetFileInformationByHandle
PeekNamedPipe
DeleteFileW
GetDriveTypeW
GetFullPathNameA
GetFileAttributesW
WriteFile
GetConsoleCP
GetConsoleMode
MoveFileW
FindFirstFileExW
InterlockedDecrement
InterlockedIncrement
CreateProcessW
DuplicateHandle
FlushFileBuffers
RtlUnwind
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
DeleteFileA
SetLastError
GetCurrentThread
HeapCreate
HeapDestroy
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
LoadLibraryW
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
HeapQueryInformation
GetProcessHeap
LCMapStringW
GetCurrentDirectoryW
SetCurrentDirectoryW
WriteConsoleW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
CreatePipe
RaiseException
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
CreateFileA
SetEnvironmentVariableW
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
MultiByteToWideChar
SetCurrentDirectoryA
InterlockedExchange
InterlockedCompareExchange
Sleep
GetDriveTypeA
FindFirstFileExA
ExitThread
ResumeThread
FileTimeToLocalFileTime
CreateThread
ReadFile
TlsFree
LoadLibraryA
GetSystemDirectoryA
CreateMutexA
ReleaseMutex
InitializeCriticalSection
lstrlenA

user32

MessageBoxA
EmptyClipboard
SetClipboardData
OpenClipboard
ReleaseDC
GetDC
CloseClipboard
GetClipboardData

gdi32

CreateCompatibleDC
GetObjectA
CreateDIBSection
DeleteObject
DeleteDC
SelectPalette
RealizePalette
BitBlt
CreateBitmapIndirect
SelectObject

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumValueA

oleaut32

SafeArrayUnaccessData
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData

wsock32

ioctlsocket
WSAGetLastError
gethostbyname
inet_addr
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
WSACleanup
closesocket
select
send
recv
getsockopt
__WSAFDIsSet
connect
inet_ntoa
socket
WSAStartup
listen
bind
getsockname

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 294KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a3366ab34fa8ef110ee311776cfea24e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcomp100

kernel32

user32

gdi32

advapi32

oleaut32

wsock32

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 294KB - Virtual size: 470KB

.rsrc Size: 120KB - Virtual size: 120KB

.reloc Size: 156KB - Virtual size: 156KB

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 294KB - Virtual size: 470KB

.rsrc
Size: 120KB - Virtual size: 120KB

.reloc
Size: 156KB - Virtual size: 156KB