2024-03-06_19b4d74a1bbd5925ed4fc0e3a86f204d_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-06_19b4d74a1bbd5925ed4fc0e3a86f204d_mafia
Size

327KB
MD5

19b4d74a1bbd5925ed4fc0e3a86f204d
SHA1

dca0f9d2632e9b3340784fcdeb9fdda80416ab3a
SHA256

770ec381f5e70f335cae9124bff7a3f11dc1c5b62af23c84b8d7aeab9050a249
SHA512

e79bbc19c0d4a7fdcd33d5a8da5ae82af9d0cd725cad1851b1a71b2a58cef29c3eb2186aca10384ac78d58166b4c60146024fec84140681f553a07922b796421
SSDEEP

6144:EuIc5GtTQQcud+fZMgp/HbLcQACoETzb97TLHx5u:ELtTQqdwZNp/HbLc2oETzb9RU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-06_19b4d74a1bbd5925ed4fc0e3a86f204d_mafia

Files

2024-03-06_19b4d74a1bbd5925ed4fc0e3a86f204d_mafia
.exe windows:5 windows x86 arch:x86

b8d6582d3fcc64d58d502602ca3f7f8e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\SHARED_10.5.0\iA.cwin.Shared\10.5.0-branch\obj\RELEASE\bin\scan\p4tolocal.pdb

Imports

kernel32

CreateProcessA
SetHandleInformation
GetStdHandle
CreateMutexA
ReleaseMutex
WaitForSingleObject
CloseHandle
FormatMessageA
GetComputerNameA
FindClose
FindFirstFileA
UnlockFileEx
LockFileEx
CopyFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
GetConsoleMode
GetCurrentThreadId
SetConsoleMode
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
DeleteFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetFullPathNameA
GetDriveTypeW
RemoveDirectoryA
GetDriveTypeA
GetProcessHeap
SetEndOfFile
CreateFileW
GetTimeZoneInformation
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
SetEnvironmentVariableA
CompareStringW
GetExitCodeProcess
WriteConsoleW
LCMapStringW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
RtlUnwind
SetStdHandle
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileType
RaiseException
HeapFree
SetFileAttributesA
GetCommandLineA
HeapSetInformation
InterlockedExchange
MultiByteToWideChar
ReadFile
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
SetConsoleCtrlHandler
CreatePipe
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
MoveFileA
HeapAlloc
HeapReAlloc
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
FatalAppExitA
Sleep
WriteFile
WideCharToMultiByte
GetConsoleCP
FlushFileBuffers
HeapCreate
HeapDestroy
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetLocaleInfoW
FreeLibrary
SetCurrentDirectoryW

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
GetUserNameA

unittest_scan

?SetTestLogger@TestLogger@unittest@@SAXPBV12@@Z
??0GlobalMutex@unittest@@QAE@PBDK@Z
?Enter@GlobalMutex@unittest@@UAE_NXZ
?Leave@GlobalMutex@unittest@@UAEXXZ
??1GlobalMutex@unittest@@UAE@XZ
??0TestLogger@unittest@@IAE@XZ
??1TestLogger@unittest@@UAE@XZ
?GetTestLogger@TestLogger@unittest@@SAPBV12@XZ

wsock32

gethostname
WSAGetLastError
recv
send
getpeername
connect
accept
closesocket
getsockname
socket
setsockopt
bind
listen
WSACleanup
WSAStartup
gethostbyaddr
ntohs
htons
getservbyname
htonl
ioctlsocket
gethostbyname

Sections

.text
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b8d6582d3fcc64d58d502602ca3f7f8e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

unittest_scan

wsock32

Sections

.text Size: 268KB - Virtual size: 268KB

.rdata Size: 31KB - Virtual size: 31KB

.data Size: 13KB - Virtual size: 27KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 11KB - Virtual size: 11KB

.text
Size: 268KB - Virtual size: 268KB

.rdata
Size: 31KB - Virtual size: 31KB

.data
Size: 13KB - Virtual size: 27KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 11KB