2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia
Size 486KB
Sample240311-2l99laaf35
SHA256 331750ab4ca12685f410977a650c7a3663d542e3ecf80c65b39e0124e5e36523
MD5 1c738a52f882ddf1a1283aac69ebed50
SHA1 3b296ca82e6f0fd1af36bcfa90c8549e49f2c066
SHA512 65698def5b76cf142197a61dae190a735c97218c8b5ec3cc55640e0f1bdbd9ee88e8648d4ba1c606b1be8b623e5b9e415658602f26ea1b614ecf697b53d0fead
SSDEEP 6144:pRPu8zwNAZ5CZrIik3tHV/CrnXWXqe9EA8amtc1n3X+vSFwSe/bsH2f6:pkrIik3X/CrnGH5VmtWX+vSjU6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia

File Explorer

2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia

.exe 486KB

2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia

IMPHASH 2db4fba7eea2d94ca8042891d0a35f45
SHA256 331750ab4ca12685f410977a650c7a3663d542e3ecf80c65b39e0124e5e36523
MD5 1c738a52f882ddf1a1283aac69ebed50
SHA1 3b296ca82e6f0fd1af36bcfa90c8549e49f2c066
SHA512 65698def5b76cf142197a61dae190a735c97218c8b5ec3cc55640e0f1bdbd9ee88e8648d4ba1c606b1be8b623e5b9e415658602f26ea1b614ecf697b53d0fead
SSDEEP 6144:pRPu8zwNAZ5CZrIik3tHV/CrnXWXqe9EA8amtc1n3X+vSFwSe/bsH2f6:pkrIik3X/CrnGH5VmtWX+vSjU6
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW GetLocalTime GetComputerNameW SystemTimeToFileTime FileTimeToSystemTime SizeofResource LockResource LoadResource FindResourceW FindResourceExW MultiByteToWideChar GetProcAddress LoadLibraryW GetCurrentProcess LeaveCriticalSection EnterCriticalSection DeleteCriticalSection WaitForSingleObject InitializeCriticalSection GetLastError CloseHandle WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess Sleep MoveFileW DeleteFileW CreateDirectoryW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW lstrlenW CreateFileW GetFileSize ReadFile WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW GetSystemTime FileTimeToLocalFileTime RaiseException InitializeCriticalSectionAndSpinCount HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalAlloc WaitForMultipleObjects GetModuleHandleA ProcessIdToSessionId SetEndOfFile SetStdHandle WriteConsoleW LoadLibraryA FreeLibrary GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA InterlockedIncrement InterlockedDecrement InterlockedExchange EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW ExitThread GetCurrentThreadId CreateThread RtlUnwind LCMapStringW GetCPInfo SetUnhandledExceptionFilter ExitProcess GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetConsoleCP GetConsoleMode GetACP GetOEMCP IsValidCodePage SetFilePointer FlushFileBuffers GetUserDefaultLCID GetLocaleInfoW

ole32

CoCreateInstance CoInitialize

shlwapi

PathFileExistsW PathIsRootW PathAppendW PathAddExtensionW PathRemoveExtensionW

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

145KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

222KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-11_1c738a52f882ddf1a1283aac69ebed50_mafia

kernel32

ole32

shlwapi

psapi

wtsapi32

userenv

generic