2024-02-21_1260bc2c9debc3b6adfd81ba085bdf95_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-02-21_1260bc2c9debc3b6adfd81ba085bdf95_mafia
Size

691KB
MD5

1260bc2c9debc3b6adfd81ba085bdf95
SHA1

59d9e29c22f2b68b944aebd585423b3543f90f1a
SHA256

6a344293a77d0ea59621ef2c532a3681ccf2566782c9410a00ec5baa09e161c2
SHA512

9175335c8ac03d24211aca7ad8174306a6b114e2b7951de99f5659c568e3d8476f78910403b78941c6e0279b52c07258e21c46c25d008ff8db6ce03d824dca9e
SSDEEP

12288:aqshwu2iOSK1bjRV/aNqeheOBtinWEgw0bf+P0yPO0xad3nHSPx0+cvcF/JkYbkY:ruMjR6BtqgfUtJkYosJkFMH47p0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-21_1260bc2c9debc3b6adfd81ba085bdf95_mafia

Files

2024-02-21_1260bc2c9debc3b6adfd81ba085bdf95_mafia
.exe windows:5 windows x86 arch:x86

9f91e6ac9fbfaf40750e2aaad8570895

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

N:\svn\trunk\NGAIS\SW\WinApps\Product\DbgTool\Debug\DbgTool.pdb

Imports

ws2_32

getpeername
getsockname
ioctlsocket
getsockopt
setsockopt
recvfrom
recv
sendto
send
shutdown
connect
accept
listen
bind
select
__WSAFDIsSet
closesocket
socket
WSAStartup
gethostbyname
inet_ntoa
inet_addr
ntohl
ntohs
htonl
htons

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

winmm

timeKillEvent
timeSetEvent

kernel32

IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
CreateProcessA
GetExitCodeProcess
GetLocaleInfoW
InterlockedExchange
WriteConsoleW
SetConsoleCtrlHandler
SetStdHandle
PeekNamedPipe
GetFileInformationByHandle
LoadLibraryW
lstrlenA
SetFilePointer
GetConsoleCP
RtlUnwind
FatalAppExitA
HeapReAlloc
FreeLibrary
GetProcessHeap
CreateFileW
MultiByteToWideChar
LCMapStringW
Sleep
GetComputerNameA
SetComputerNameA
SetSystemTime
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
CloseHandle
CreateFileA
EnterCriticalSection
PurgeComm
SetCommTimeouts
SetupComm
CreateEventA
GetLastError
SetCommState
VirtualQuery
ClearCommError
GetOverlappedResult
ReadFile
ClearCommBreak
SetCommBreak
WriteFile
EscapeCommFunction
GetCommModemStatus
GetCommProperties
DeviceIoControl
WideCharToMultiByte
WaitForMultipleObjects
PulseEvent
SetEvent
ResetEvent
WaitForSingleObject
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
SetThreadPriority
TerminateThread
DuplicateHandle
GetCurrentProcess
RaiseException
GetCurrentThread
GetThreadPriority
GetFileAttributesA
CancelIo
SleepEx
ReadDirectoryChangesW
GetDiskFreeSpaceA
GetLogicalDriveStringsA
FindFirstFileA
FindNextFileA
FindClose
FlushFileBuffers
TryEnterCriticalSection
LocalAlloc
LocalFree
SetProcessPriorityBoost
SetProcessAffinityMask
CreateMutexA
ReleaseMutex
GetCommTimeouts
SetEndOfFile
HeapSize
CompareStringW
GetCommState
GetCommandLineA
HeapSetInformation
CreateDirectoryA
HeapFree
GetSystemTimeAsFileTime
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetTimeFormatA
GetDateFormatA
MoveFileA
DeleteFileA
HeapAlloc
GetTimeZoneInformation
ExitThread
ResumeThread
CreateThread
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeW
GetFullPathNameA
RemoveDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapValidate
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
HeapDestroy
GetCurrentProcessId
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Sections

.text
Size: 531KB - Virtual size: 530KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f91e6ac9fbfaf40750e2aaad8570895

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

winmm

kernel32

advapi32

Sections

.text Size: 531KB - Virtual size: 530KB

.rdata Size: 69KB - Virtual size: 69KB

.data Size: 57KB - Virtual size: 120KB

.idata Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 25KB - Virtual size: 24KB

.text
Size: 531KB - Virtual size: 530KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 57KB - Virtual size: 120KB

.idata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 25KB - Virtual size: 24KB