2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi

General

Target
2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi
Size 479KB
Sample240302-vtc6hafc8s
SHA256 1a20605a141bab8b5caaed7529d59a98bfa6eaa0b3c5be4a1a0608919713c4ce
MD5 ab1dfc26cc8cfff61b7d870ce451070d
SHA1 17531736c31c07a3a4a560b840cddcf8215d2c16
SHA512 046e2383a164af992c2f63cd8c9108453558b1a595806b24aadd5ef272c7d02493c68f2d2153b7ce43edfd0a73f6b36551cce36db3f124bdf3a77da882192be4
SSDEEP 6144:FhGib/+3pk4crU/zaqW+zufG6+/ZO5mrr:FhGib/+3KnrULzW+zuO6+/Zeu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi

File Explorer

2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi

.exe 479KB

2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi

IMPHASH 7ad73542e818153444f3c96b653453c3
SHA256 1a20605a141bab8b5caaed7529d59a98bfa6eaa0b3c5be4a1a0608919713c4ce
MD5 ab1dfc26cc8cfff61b7d870ce451070d
SHA1 17531736c31c07a3a4a560b840cddcf8215d2c16
SHA512 046e2383a164af992c2f63cd8c9108453558b1a595806b24aadd5ef272c7d02493c68f2d2153b7ce43edfd0a73f6b36551cce36db3f124bdf3a77da882192be4
SSDEEP 6144:FhGib/+3pk4crU/zaqW+zufG6+/ZO5mrr:FhGib/+3KnrULzW+zuO6+/Zeu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

499712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\derek\dr\build_package\build_drmemory-release-32\dynamorio\bin32\DRkill.pdb

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken OpenThreadToken InitiateSystemShutdownW SetNamedSecurityInfoW GetNamedSecurityInfoW RegDeleteKeyW RegCloseKey RegCreateKeyExW FreeSid SetEntriesInAclW AllocateAndInitializeSid LookupAccountNameW AddAccessAllowedAce InitializeAcl GetLengthSid RegSetKeySecurity IsValidSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner InitializeSecurityDescriptor RegOpenKeyExW GetSecurityInfo RegEnumKeyExW RegEnumValueW RegDeleteValueW RegQueryValueExW RegSetValueExW RegOpenKeyW CloseEventLog ReadEventLogW GetOldestEventLogRecord GetNumberOfEventLogRecords NotifyChangeEventLog OpenEventLogW ClearEventLogW

kernel32

GetLastError ReadProcessMemory CloseHandle OpenProcess GetProcAddress GetModuleHandleW TerminateProcess SleepEx GetCurrentProcess GetCurrentThread FindClose FindFirstFileW MoveFileExW MoveFileW DeleteFileW LocalFree GetShortPathNameW GetSystemDirectoryW CreateDirectoryW RemoveDirectoryW FindNextFileW LocalAlloc GetExitCodeProcess WaitForSingleObject CreateProcessW CopyFileW ResumeThread GetThreadContext CreateThread VirtualFreeEx WriteProcessMemory VirtualProtectEx VirtualAllocEx CreateRemoteThread CreateFileW ExpandEnvironmentStringsW FormatMessageW LoadLibraryExW CreateEventW GetCurrentProcessId HeapFree HeapAlloc GetProcessHeap ExitProcess DecodePointer EnterCriticalSection LeaveCriticalSection GetCommandLineA HeapSetInformation MultiByteToWideChar ReadFile GetFileType GetStringTypeW InitializeCriticalSectionAndSpinCount DeleteCriticalSection FatalAppExitA EncodePointer SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryW GetLocaleInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameW SetHandleCount GetStartupInfoW Sleep GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetConsoleCP GetConsoleMode RtlUnwind SetStdHandle SetFilePointer SetEndOfFile HeapSize HeapReAlloc FlushFileBuffers WriteConsoleW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

P^E��u}

Size

16KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-02_ab1dfc26cc8cfff61b7d870ce451070d_mafia_wapomi

advapi32

kernel32

generic