2024-02-18_8ab6204ccedcd95948f953f966e8ce9e_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-18_8ab6204ccedcd95948f953f966e8ce9e_mafia
Size

492KB
MD5

8ab6204ccedcd95948f953f966e8ce9e
SHA1

0a2734fd40bf700c9e6effb0dffd624d28e85ff9
SHA256

cf8014cf41c38b0468d1c4bd031d8631aa26232519cd995df8552fd0abc166a5
SHA512

85c9e0686c982fd564334da86322e775a4a8411a0969d77a7b127d96a7d2f7fd67ca94aa6ef2ac727af1832d9656f4a8802a8d4cf3139ce9221037c3956242b5
SSDEEP

12288:90gjszdH8biS2790TBUwA3oUaUITgbPOGl9lG0YE:90gUdH/X76CwAYUaUIKxjl3YE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-18_8ab6204ccedcd95948f953f966e8ce9e_mafia

Files

2024-02-18_8ab6204ccedcd95948f953f966e8ce9e_mafia
.exe windows:5 windows x86 arch:x86

42847e47301fd5d876375c9bce6f0074

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Users\cc4build\Documents\Visual Studio 2010\Work\Application\ControlCenter\ControlCenter4\Product\Develop\ControlCenter4_DSLFB\binary\Release\BrCtrlCntr.pdb

Imports

shlwapi

PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathAddBackslashW
StrStrIA
StrStrIW

wininet

InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetSetStatusCallbackW
InternetReadFileExA
InternetConnectA
HttpQueryInfoA
InternetErrorDlg

kernel32

WideCharToMultiByte
LoadLibraryW
CreateFileW
MultiByteToWideChar
GetLastError
GetProcAddress
ResetEvent
CreateEventW
CloseHandle
lstrcmpiW
FindFirstFileW
Sleep
FindClose
WaitForMultipleObjects
FindNextFileW
lstrcpyW
DeleteFileW
MoveFileExW
OpenEventW
CreateProcessW
lstrlenW
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
OpenFileMappingW
SetFilePointerEx
ReadFile
GetFileSizeEx
CreateDirectoryW
GetDateFormatW
GetLocalTime
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetACP
IsValidCodePage
GetLocaleInfoW
GetCurrentThreadId
GetModuleFileNameW
CreateMutexW
WriteFile
ReleaseMutex
GetCurrentProcess
GetVolumeInformationW
PeekNamedPipe
WaitNamedPipeW
FlushFileBuffers
GetFileSize
FileTimeToSystemTime
GetFileTime
FileTimeToLocalFileTime
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreW
OpenSemaphoreW
lstrcpynW
lstrcmpW
lstrcatW
QueryPerformanceCounter
ResumeThread
GetFileAttributesW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetOEMCP
GetStdHandle
ExitProcess
HeapSize
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
RtlUnwind
GetCPInfo
RaiseException
GetStartupInfoW
HeapSetInformation
GetPrivateProfileStringW
SetEvent
WaitForSingleObject
FreeLibrary
GetCurrentProcessId
GetCommandLineW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleMode
GetConsoleCP
SetStdHandle
WriteConsoleW
GetStringTypeW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
SetLastError
GetTempPathW
CreateThread
ExitThread
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection

user32

IsWindow
DrawTextW
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
WaitForInputIdle
wsprintfW
PostMessageW
wsprintfA
LoadStringW
CharUpperW
SendMessageW

gdi32

SetTextColor
SetBkMode
DeleteObject
SelectObject
SetMapMode
StretchDIBits
CreateFontW
SetStretchBltMode
PatBlt

comdlg32

GetSaveFileNameW

advapi32

RegOpenKeyExW
RegQueryValueExW
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptCreateHash
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
RegCloseKey

shell32

DoEnvironmentSubstW
SHGetFolderPathW
SHFileOperationW

ole32

CoInitialize
CoUninitialize

oleaut32

SysFreeString

vcomp100

_vcomp_fork
_vcomp_for_static_simple_init
_vcomp_for_static_end

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

42847e47301fd5d876375c9bce6f0074

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

vcomp100

Sections

.text Size: 356KB - Virtual size: 356KB

.rdata Size: 72KB - Virtual size: 72KB

.data Size: 8KB - Virtual size: 60KB

.rsrc Size: 28KB - Virtual size: 28KB

.reloc Size: 26KB - Virtual size: 25KB

.text
Size: 356KB - Virtual size: 356KB

.rdata
Size: 72KB - Virtual size: 72KB

.data
Size: 8KB - Virtual size: 60KB

.rsrc
Size: 28KB - Virtual size: 28KB

.reloc
Size: 26KB - Virtual size: 25KB