2024-02-28_539906426a081124a0673f834a638abc_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-28_539906426a081124a0673f834a638abc_mafia
Size

389KB
MD5

539906426a081124a0673f834a638abc
SHA1

aa0c7fe40bb8074705487742f348930e12ffd4c0
SHA256

77bf12a501cc7219b28c90d6b25672fd8ac28c1467f10a3459bcd4ff888cd8c3
SHA512

bffb76fa23dc7a17598b4a782a4cf3b7b821de175324c3401bf76e241ba5865f8b709b08a2aec9c54f600d927ae41e7b52b21e57fd8db3348b3733ac2595e1c5
SSDEEP

6144:Kf9FnK+IRl/UArV5cjjjiSvTB/bY64kcZctlAyQ5xT51Hg3IDh:M9FnK+IfpVGnBd/c64kKolAxR5hDh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-28_539906426a081124a0673f834a638abc_mafia

Files

2024-02-28_539906426a081124a0673f834a638abc_mafia
.exe windows:5 windows x86 arch:x86

dd565cf1d704bd5756423c95ddf56b7d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Projects\mp3recoder\Release\mp3recoder.pdb

Imports

libintl

libintl_dgettext
libintl_textdomain
libintl_bindtextdomain
libintl_gettext

shell32

SHGetSpecialFolderPathA

user32

PostThreadMessageA

kernel32

GetStartupInfoW
GetProcessHeap
SetEvent
LoadLibraryExW
LoadLibraryExA
GetLastError
GetFileAttributesA
GetFileAttributesW
CreateDirectoryA
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
DeleteFileA
DeleteFileW
GetCurrentThreadId
GetEnvironmentVariableA
GetModuleFileNameW
SetFilePointer
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
FormatMessageA
WaitForSingleObject
ReadFile
CreateEventA
WriteFile
CloseHandle
GetTempPathA
CreateFileA
CreateFileW
GetTempFileNameA
GetLocalTime
GetSystemTime
GetFileInformationByHandle
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
SetConsoleCtrlHandler
GetCPInfo
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
FreeLibrary
LoadLibraryW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEndOfFile
GetThreadLocale
CreateThread
SetThreadLocale
TerminateThread
ReleaseMutex
CreateMutexA

libmpg123-0

mpg123_decode
mpg123_exit
mpg123_getformat
mpg123_open_feed
mpg123_new
mpg123_plain_strerror
mpg123_delete
mpg123_init

ws2_32

getservbyname
gethostbyname
connect
getsockopt
WSASetLastError
socket
setsockopt
inet_addr
htonl
htons
bind
WSAGetLastError
closesocket
inet_ntoa
ioctlsocket
send
recv
ntohs
getpeername
getsockname
select
listen

libeay32

ord2291
ord406
ord219
ord216
ord731
ord728
ord1984
ord386
ord218
ord834
ord831
ord211
ord210
ord209
ord486
ord949
ord410
ord498
ord495
ord753
ord750
ord947
ord390
ord497
ord856
ord853
ord485
ord484
ord504
ord503
ord502
ord1043
ord1042
ord1044
ord342
ord341
ord340
ord2101
ord181
ord227
ord213

Sections

.text
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dd565cf1d704bd5756423c95ddf56b7d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libintl

shell32

user32

kernel32

libmpg123-0

ws2_32

libeay32

Sections

.text Size: 300KB - Virtual size: 299KB

.rdata Size: 57KB - Virtual size: 56KB

.data Size: 8KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 880B

.reloc Size: 22KB - Virtual size: 21KB

.text
Size: 300KB - Virtual size: 299KB

.rdata
Size: 57KB - Virtual size: 56KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 880B

.reloc
Size: 22KB - Virtual size: 21KB