2024-03-07_6a6156b7caaead9257bc0cb22cc21fca_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-07_6a6156b7caaead9257bc0cb22cc21fca_mafia
Size

220KB
MD5

6a6156b7caaead9257bc0cb22cc21fca
SHA1

3d24013a6d34baaf3aebc882386b73863a88d1e5
SHA256

6060a99e5694075938837f41db8a901859e9aacd0c8bebe1a8e7771c58392bc2
SHA512

be0789a956a0e1ebe9a93f9c21c703ddfb08faa66de99426068fd6ba624002135566960606a3736162f57b26986ede9bccc6acd87c2c73d28278bd9f5e9c4a75
SSDEEP

3072:+qSIvM8ki8N7paWeEadWEpYafKSfQEb/u69pdCOX:lTMrnF4WEXb/79pp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-07_6a6156b7caaead9257bc0cb22cc21fca_mafia

Files

2024-03-07_6a6156b7caaead9257bc0cb22cc21fca_mafia
.exe windows:5 windows x86 arch:x86

6fc6f038d8b9d52675f50939c2a3c25e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\mcci+ReleaseWin32_7-4-0_release\mcci\McciContext\McciContextHookShim\SourceCode\Win32\Release\pcContextHookShim.pdb

Imports

kernel32

IsBadCodePtr
SuspendThread
ResumeThread
GetCurrentThread
ResetEvent
CreateEventA
TerminateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
PulseEvent
ReleaseMutex
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryA
LeaveCriticalSection
CompareStringW
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
LCMapStringW
LoadLibraryW
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetWindowsDirectoryA
Sleep
GetTickCount
GetCurrentThreadId
GetModuleFileNameA
GetCurrentProcessId
OutputDebugStringA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
CloseHandle
GetVersionExA
GetModuleHandleA
GetACP
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FindResourceExW
GetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetCPInfo
RaiseException
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
SetEnvironmentVariableA

user32

LoadIconA
UpdateWindow
ShowWindow
LoadStringA
GetMessageA
TranslateMessage
DispatchMessageA
GetFocus
LoadCursorA
RegisterClassExA
DefWindowProcA
PostQuitMessage
CreateWindowExA

advapi32

RegOpenKeyExW
RegQueryValueExW
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
GetUserNameA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoInitialize
CoUninitialize

shlwapi

PathAppendW
PathFileExistsA
PathStripPathW
PathAddBackslashW

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fc6f038d8b9d52675f50939c2a3c25e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 115KB - Virtual size: 114KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 115KB - Virtual size: 114KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 14KB - Virtual size: 14KB