2024-03-10_8ec6aadd40d7a81d8505032b0accd253_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-10_8ec6aadd40d7a81d8505032b0accd253_mafia
Size

667KB
MD5

8ec6aadd40d7a81d8505032b0accd253
SHA1

072235e26e4ce6775e16881ee71fb88535626292
SHA256

fddd4f41488eff8dd69fcc8007dae0a3f605018c094965cadceda7641b51c265
SHA512

3bc465e042ab0ffbb8ea0f8ecaa33e7a05e5cdadfa5d5e062ce3e2c796d355d5a36486d43a9e87c3a991bb3ee241e99950349c59bcdaa3f1bd9cf5b1e1f09540
SSDEEP

12288:kIzIkmWME66Ff8A+r00P7mDXRK1q/yNjFPhhRlZfnl+slHMYC8:JzIkGEjf8vtyDXR6q/ylfnl+sOl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-10_8ec6aadd40d7a81d8505032b0accd253_mafia

Files

2024-03-10_8ec6aadd40d7a81d8505032b0accd253_mafia
.exe windows:5 windows x86 arch:x86

39c4e854826fc7054d4309c4110ac668

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\CodesysSpV3_Branches_V3.5\CodesysSpV3\Platforms\Windows\GatewayService\Release\Win32\GatewayService\GatewayService.pdb

Imports

wsock32

sendto
recvfrom
send
recv
inet_ntoa
shutdown
select
connect
accept
listen
ntohl
ntohs
htonl
htons
ioctlsocket
inet_addr
gethostbyname
gethostname
bind
getsockopt
setsockopt
closesocket
socket
WSAGetLastError
WSAStartup
WSACleanup

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime

iphlpapi

GetAdaptersInfo

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiClassGuidsFromNameA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

IsValidCodePage
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
SetConsoleCtrlHandler
GetStdHandle
AllocConsole
GetTickCount
Sleep
SetCurrentDirectoryA
GetModuleFileNameA
LocalFree
FormatMessageA
GetLastError
GetVersionExA
CreateFileA
SetCommTimeouts
GetCommTimeouts
SetCommState
GetCommState
PurgeComm
SetupComm
CloseHandle
ReadFile
WriteFile
CreateEventA
SetEvent
WaitForSingleObject
SetFilePointer
CreateDirectoryA
DeleteFileA
MoveFileA
GetFileSize
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
SystemTimeToFileTime
CopyFileA
FlushFileBuffers
VirtualLock
VirtualAlloc
SetHandleCount
VirtualUnlock
VirtualQuery
IsBadReadPtr
IsBadWritePtr
LoadLibraryA
FreeLibrary
GetProcAddress
InitializeCriticalSection
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
GetLocalTime
DeleteCriticalSection
TryEnterCriticalSection
CreateThread
TerminateThread
SuspendThread
ResumeThread
GetExitCodeThread
GetCurrentThreadId
SetThreadPriority
GetThreadContext
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAdjustment
DeviceIoControl
CreateMutexA
ReleaseMutex
FlushInstructionCache
GetCurrentProcess
InterlockedExchangeAdd
SetProcessWorkingSetSize
GetProcessHeap
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
GetComputerNameA
GetVolumeInformationA
GetSystemTime
GetTimeZoneInformation
SetSystemTime
SetTimeZoneInformation
TlsAlloc
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineA
FatalAppExitA
CreateFileW
RtlUnwind
GetConsoleCP
RaiseException
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
HeapCreate
HeapDestroy
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
HeapSize
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
VirtualFree
GetProcessWorkingSetSize
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
HeapReAlloc

user32

GetSubMenu
TrackPopupMenu
SetForegroundWindow
DefWindowProcA
LoadMenuA
GetCursorPos
LoadStringA
wsprintfA
DestroyWindow

advapi32

AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RegisterServiceCtrlHandlerA
StartServiceA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyA
RegSetValueExA
RegCloseKey
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
SetServiceStatus
InitializeSecurityDescriptor

Sections

.text
Size: 526KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39c4e854826fc7054d4309c4110ac668

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wsock32

winmm

iphlpapi

setupapi

version

kernel32

user32

advapi32

Sections

.text Size: 526KB - Virtual size: 525KB

.rdata Size: 99KB - Virtual size: 99KB

.data Size: 7KB - Virtual size: 249KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 29KB - Virtual size: 29KB

.text
Size: 526KB - Virtual size: 525KB

.rdata
Size: 99KB - Virtual size: 99KB

.data
Size: 7KB - Virtual size: 249KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 29KB - Virtual size: 29KB