2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia
Size 4.0MB
Sample240311-ef6b5abd97
SHA256 86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac
MD5 e9700ee19d13bc5d0bff829cfd9335df
SHA1 67d67d24e0d0c5bf3e0f9d54a219caf2245fd092
SHA512 c8aad6429933b30fc74a61a7cad7226c55e04f8cd4436bd4581decf5bbaaea1eee74ca7a09262e12b9f512337e37c9d2e7e86f732c8e18cfc674b92d82086da0
SSDEEP 49152:e1aJm5TYkvCkXUfHR/SuF5QZuTtS0rQMYOQ+q8CEM3YHcY0W3luNaeae7nHzc9KG:0U0SfHxSuFWsM0r1QnbAO5zvc0FeZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

File Explorer

2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

.exe 4.0MB

2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

IMPHASH 0bd7e6446dbf9cf6b35b156a80d5b05a
SHA256 86211b1efe265d6cf39c86d8af98dd99fc0a927dd4465362b0cfc24aa23e86ac
MD5 e9700ee19d13bc5d0bff829cfd9335df
SHA1 67d67d24e0d0c5bf3e0f9d54a219caf2245fd092
SHA512 c8aad6429933b30fc74a61a7cad7226c55e04f8cd4436bd4581decf5bbaaea1eee74ca7a09262e12b9f512337e37c9d2e7e86f732c8e18cfc674b92d82086da0
SSDEEP 49152:e1aJm5TYkvCkXUfHR/SuF5QZuTtS0rQMYOQ+q8CEM3YHcY0W3luNaeae7nHzc9KG:0U0SfHxSuFWsM0r1QnbAO5zvc0FeZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detects executables packed with VMProtect.
UPX dump on OEP (original entry point)
VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

622891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesA CreateDirectoryA DeleteFileA GetSystemDirectoryA FindResourceW SizeofResource LoadResource LockResource FreeResource VirtualQuery CreateToolhelp32Snapshot Process32FirstW lstrcmpiW Process32NextW OpenProcess GetProcessTimes FileTimeToLocalFileTime FileTimeToSystemTime InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection Sleep CreateThread GetComputerNameA GlobalAlloc GlobalFree GetNativeSystemInfo CreateProcessW UpdateProcThreadAttribute GetModuleHandleW IsBadReadPtr GetProcAddress InitializeProcThreadAttributeList GetThreadContext SetThreadContext CreateRemoteThread TerminateProcess VirtualAllocEx WriteProcessMemory ResumeThread GetTickCount CreateFileW GetTempPathA SetEndOfFile WriteFile GetLastError SystemTimeToFileTime ReadFile GetCurrentDirectoryW LocalFileTimeToFileTime GetCommandLineA GetLogicalDriveStringsA GetCurrentThread SetThreadPriority GetCurrentProcess SetPriorityClass CloseHandle GetModuleFileNameA LocalAlloc LocalFree WideCharToMultiByte MultiByteToWideChar WriteConsoleW SetStdHandle CreateFileA GetProcessHeap LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW LCMapStringW GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoW GetFileType HeapFree HeapAlloc EncodePointer DecodePointer HeapReAlloc HeapSetInformation UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate ExitProcess GetStdHandle GetModuleFileNameW RaiseException IsProcessorFeaturePresent HeapSize InitializeCriticalSectionAndSpinCount RtlUnwind SetHandleCount GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

LoadStringA

advapi32

RegCloseKey LookupPrivilegeValueW CreateProcessAsUserW OpenProcessToken RegQueryValueExA RegEnumKeyExA RegOpenKeyExA AdjustTokenPrivileges

shell32

SHGetFolderPathA CommandLineToArgvW SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHChangeNotify ShellExecuteA SHGetFolderPathW

shlwapi

PathFileExistsW StrStrA PathRemoveFileSpecA PathFileExistsA

winhttp

WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpSendRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpCloseHandle

rpcrt4

UuidCreateSequential

iphlpapi

GetAdaptersInfo SendARP

ws2_32

gethostbyname inet_ntoa WSACleanup inet_addr WSAStartup

GetModuleHandle64 GetProcAddress64 GetThreadContext64 ReadProcessMemory64 SetLastErrorFromX64Call SetThreadContext64 VirtualAllocEx64 VirtualFreeEx64 VirtualProtectEx64 VirtualQueryEx64 WriteProcessMemory64 X64Call _cJSON_AddArrayToObject@8 _cJSON_AddBoolToObject@12 _cJSON_AddFalseToObject@8 _cJSON_AddItemReferenceToArray@8 _cJSON_AddItemReferenceToObject@12 _cJSON_AddItemToArray@8 _cJSON_AddItemToObject@12 _cJSON_AddItemToObjectCS@12 _cJSON_AddNullToObject@8 _cJSON_AddNumberToObject@16 _cJSON_AddObjectToObject@8 _cJSON_AddRawToObject@12 _cJSON_AddStringToObject@12 _cJSON_AddTrueToObject@8 _cJSON_Compare@12 _cJSON_CreateArray@0 _cJSON_CreateArrayReference@4 _cJSON_CreateBool@4 _cJSON_CreateDoubleArray@8 _cJSON_CreateFalse@0 _cJSON_CreateFloatArray@8 _cJSON_CreateIntArray@8 _cJSON_CreateNull@0 _cJSON_CreateNumber@8 _cJSON_CreateObject@0 _cJSON_CreateObjectReference@4 _cJSON_CreateRaw@4 _cJSON_CreateString@4 _cJSON_CreateStringArray@8 _cJSON_CreateStringReference@4 _cJSON_CreateTrue@0 _cJSON_Delete@4 _cJSON_DeleteItemFromArray@8 _cJSON_DeleteItemFromObject@8 _cJSON_DeleteItemFromObjectCaseSensitive@8 _cJSON_DetachItemFromArray@8 _cJSON_DetachItemFromObject@8 _cJSON_DetachItemFromObjectCaseSensitive@8 _cJSON_DetachItemViaPointer@8 _cJSON_Duplicate@8 _cJSON_GetArrayItem@8 _cJSON_GetArraySize@4 _cJSON_GetErrorPtr@0 _cJSON_GetObjectItem@8 _cJSON_GetObjectItemCaseSensitive@8 _cJSON_GetStringValue@4 _cJSON_HasObjectItem@8 _cJSON_InitHooks@4 _cJSON_InsertItemInArray@12 _cJSON_IsArray@4 _cJSON_IsBool@4 _cJSON_IsFalse@4 _cJSON_IsInvalid@4 _cJSON_IsNull@4 _cJSON_IsNumber@4 _cJSON_IsObject@4 _cJSON_IsRaw@4 _cJSON_IsString@4 _cJSON_IsTrue@4 _cJSON_Minify@4 _cJSON_Parse@4 _cJSON_ParseWithOpts@12 _cJSON_Print@4 _cJSON_PrintBuffered@12 _cJSON_PrintPreallocated@16 _cJSON_PrintUnformatted@4 _cJSON_ReplaceItemInArray@12 _cJSON_ReplaceItemInObject@12 _cJSON_ReplaceItemInObjectCaseSensitive@12 _cJSON_ReplaceItemViaPointer@12 _cJSON_SetNumberHelper@12 _cJSON_Version@0 _cJSON_free@4 _cJSON_malloc@4

Name

.text

Size

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vmp1

Size

459KB

Virtual Size

459KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-11_e9700ee19d13bc5d0bff829cfd9335df_mafia

kernel32

user32

advapi32

shell32

shlwapi

winhttp

rpcrt4

iphlpapi

ws2_32

generic