2024-02-13_f7e166aa77584e0ae157b1de03f7d5be_mafia | Triage

Sharing

General

Target

2024-02-13_f7e166aa77584e0ae157b1de03f7d5be_mafia
Size

7.0MB
MD5

f7e166aa77584e0ae157b1de03f7d5be
SHA1

2c2032f48d377c879d159d0500b43c561199ef1a
SHA256

32d3abe90131c9f75d2e76c6ce88081b704df25f61cea5e0fea62316fb1fd47b
SHA512

b636bb1f0655940a42b60e88fd2837ecf7cbccff22cd22ad3dfb1234a290ff6a5a3dba9077396c847f8fbc0a26d55cd0ecaac8598fc9d1a2ac85da21ff2eabf9
SSDEEP

196608:yCR46CBU8ppm2sXtigQxfdzHckpkSlqWbRHdmkytQkiHi:i6UpngQxfhppRZ

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-13_f7e166aa77584e0ae157b1de03f7d5be_mafia

Files

2024-02-13_f7e166aa77584e0ae157b1de03f7d5be_mafia
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

fuckyou

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 515KB - Virtual size: 514KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 511KB - Virtual size: 511KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ