2024-02-14_eecccc88d3e4c679c2056d8c0860fb99_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-14_eecccc88d3e4c679c2056d8c0860fb99_mafia
Size

672KB
MD5

eecccc88d3e4c679c2056d8c0860fb99
SHA1

ac873217c2a4d161bf84378fea52e31e2fbaaf31
SHA256

3d267096da36dcae6389a497110e29097b76eb95a2959c9317d8897da7002667
SHA512

7acb243ad63fb02fd6a313872a015c22d147b89cd8732daf2bad174fb897548b7a15596eb9159b23ba354bc1963bd7425a9940dfebe4a1aa8c8ee62f30c367a4
SSDEEP

12288:j0g/MCcX4DRkBlsbZ0A1q1ks3Fn5E/bQNtWoCQYsBiWUrNDHQt8cXtjNcUWSztOp:j0g/MsiIcVNK/tWM9rRheNJ90CK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-14_eecccc88d3e4c679c2056d8c0860fb99_mafia

Files

2024-02-14_eecccc88d3e4c679c2056d8c0860fb99_mafia
.exe windows:5 windows x86 arch:x86

2bd87972f39f2f0ea0feb8a1e7ae4553

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\svn\neowiz\01. gDBGW\gDBGW Technology Transfer\bin\gDBGW.pdb

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetComputerNameA
EnumSystemLocalesA
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
DeleteCriticalSection
CreateSemaphoreW
InitializeCriticalSection
GetLastError
GetLocalTime
MultiByteToWideChar
GetPrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileStringW
GetPrivateProfileIntA
GetPrivateProfileSectionA
lstrlenA
GetLocaleInfoA
ExitProcess
SetLastError
GlobalAlloc
GlobalLock
lstrcpyA
lstrcatA
CloseHandle
GetTickCount
Sleep
FormatMessageW
lstrlenW
LocalAlloc
ReleaseSemaphore
WaitForSingleObject
IsValidLocale
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
LoadLibraryW
SetStdHandle
FreeLibrary
GetCurrentThreadId
SetEnvironmentVariableA
CreateFileW
GetProcessHeap
SetEndOfFile
ReadFile
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
EncodePointer
DecodePointer
GetLocaleInfoW
GetStringTypeW
LocalFree
GetFileSize
CreateFileA
TlsFree
GetUserDefaultLCID
TlsSetValue
TlsGetValue
SetConsoleCtrlHandler
TlsAlloc
CreateDirectoryW
SignalObjectAndWait
WaitForSingleObjectEx
WaitForMultipleObjects
WaitForMultipleObjectsEx
OpenSemaphoreW
CreateMutexW
OpenMutexW
ReleaseMutex
CreateEventW
OpenEventW
SetEvent
PulseEvent
ResetEvent
TryEnterCriticalSection
lstrcmpiW
GetModuleFileNameW
HeapFree
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
ExitThread
CreateThread
GetCommandLineW
HeapSetInformation
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
GetSystemTimeAsFileTime
GetTimeZoneInformation
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapCreate
HeapDestroy
GetCurrentThread
HeapSize
WriteFile
GetStdHandle
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
FatalAppExitA
WriteConsoleW

user32

MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
wsprintfW

ole32

CoInitializeEx
CoUninitialize
OleRun
CoCreateInstance

oleaut32

VariantClear
VariantChangeType
VariantCopy
VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
SetErrorInfo
CreateErrorInfo

ws2_32

inet_addr
closesocket

bdbg_vs2010

ord7

bmb_vs2010

ord9

btp_vs2010

ord1

bsig_vs2010

ord6
ord5
ord4
ord3
ord2
ord1

blstn_vs2010

ord2
ord1

blink_vs2010

ord9
ord2
ord6
ord8
ord1
ord10

blinksig_vs2010

ord1
ord2
ord3

bseh_vs2010

ord1

nwzcryptolib

nwzDecryptUC
QueryToAuthServerUC

winmm

timeGetTime

pmsconnu

?PMSInitConn@@YAKKQAPA_W@Z
?PMSStopConn@@YAXXZ
?PMSRunConn@@YAKPAUIPMSObject@@@Z
?PMSSendWarningMsg@@YAHKPBD0KK@Z

advapi32

DeregisterEventSource
RegisterEventSourceA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CreateServiceW
ReportEventA
DeleteService
ControlService
SetServiceStatus
StartServiceCtrlDispatcherW
ReportEventW
RegisterEventSourceW
RegisterServiceCtrlHandlerW

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bd87972f39f2f0ea0feb8a1e7ae4553

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

ole32

oleaut32

ws2_32

bdbg_vs2010

bmb_vs2010

btp_vs2010

bsig_vs2010

blstn_vs2010

blink_vs2010

blinksig_vs2010

bseh_vs2010

nwzcryptolib

winmm

pmsconnu

advapi32

Sections

.text Size: 546KB - Virtual size: 546KB

.rdata Size: 86KB - Virtual size: 86KB

.data Size: 11KB - Virtual size: 24KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 546KB - Virtual size: 546KB

.rdata
Size: 86KB - Virtual size: 86KB

.data
Size: 11KB - Virtual size: 24KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 25KB