2024-02-18_bcec9511ba4050c467a16c19f8656a82_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-18_bcec9511ba4050c467a16c19f8656a82_mafia
Size

145KB
MD5

bcec9511ba4050c467a16c19f8656a82
SHA1

67e6ce9a76aedd01284e455f9fbd64d6fcb3662c
SHA256

2158eddd2800ecd13f740e2ab62927164b97b1292faa46570531796b0eb02272
SHA512

ce0f2bef0506cb90c24bbf6105917c859dc368f26241e417af62fed708243e8b98006d893cef251722b432743080d2d57689f7e13ca1520dd5949fbcd250e78b
SSDEEP

1536:qIKv0ab/mOCFfdTbKOWHpw1e546uO9vfYxcj12eqSc6ZrPfnPQ6ZiCDH4OO/uAtw:fW0L7FfdTb7e5Hmo98krYSiCTO/uAt3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-18_bcec9511ba4050c467a16c19f8656a82_mafia

Files

2024-02-18_bcec9511ba4050c467a16c19f8656a82_mafia
.exe windows:5 windows x86 arch:x86

d3d972b517f507f994659a1089dd4f4d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\optikalabor\Documents\Visual Studio 2010\Projects\bentham_server\Release\bentham_server.pdb

Imports

wsock32

htonl
htons
bind
socket
listen
accept
WSAStartup
WSACleanup
recv
closesocket
send

kernel32

TlsAlloc
SetEnvironmentVariableA
CompareStringW
LoadLibraryW
WriteConsoleW
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
GetLastError
HeapFree
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetFileAttributesA
GetACP
GetOEMCP
IsValidCodePage
CreateFileW
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetStartupInfoW
ExitProcess
FlushFileBuffers
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
ReadFile
SetFilePointer
CloseHandle
GetStringTypeW
HeapReAlloc
GetUserDefaultLCID

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d3d972b517f507f994659a1089dd4f4d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

kernel32

Sections

.text Size: 107KB - Virtual size: 107KB

.rdata Size: 22KB - Virtual size: 21KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 107KB - Virtual size: 107KB

.rdata
Size: 22KB - Virtual size: 21KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 8KB - Virtual size: 8KB