2024-03-12_264fcc877dbf1c50c0445906f0ee7296_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-12_264fcc877dbf1c50c0445906f0ee7296_mafia
Size

545KB
MD5

264fcc877dbf1c50c0445906f0ee7296
SHA1

833db285dfdbeeea7fa53dd6572f05adc446ceb0
SHA256

3e6edeb3d7350f0956377902f0c266f5e8e7fd375f6f2e677f159dbacbff7f12
SHA512

2bc56cae7051fd7dda7a1934ec28d4efb8c2d00607e59cad13903f6c435eb5b30e805e689fa670fb11f4db7f59cebd6218f54bacc1202b3d1d23db20f157e8e2
SSDEEP

12288:F6xzazD5JFGox5EmYFqv0eEuXbhaney46I:F6s5JphFb8nz46I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-12_264fcc877dbf1c50c0445906f0ee7296_mafia

Files

2024-03-12_264fcc877dbf1c50c0445906f0ee7296_mafia
.exe windows:5 windows x86 arch:x86

89605709f09fdd0bc008de2aff3d7c3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\5\PSafe\PROD_PsSuite\Binaries\PsMigrationTool.pdb

Imports

kernel32

GetCurrentProcess
OpenProcess
TerminateProcess
GetModuleHandleW
GetProcAddress
FindFirstFileW
SetFileAttributesW
FindNextFileW
FindClose
MoveFileExW
CreateFileW
GetModuleHandleA
HeapAlloc
GetProcessHeap
HeapFree
LocalFree
SetEnvironmentVariableA
GetEnvironmentVariableW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
SetEndOfFile
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFileAttributesW
GetFileAttributesExW
Process32NextW
CreateDirectoryW
SetLastError
AreFileApisANSI
FormatMessageA
GetCPInfo
ExitProcess
GetCommandLineW
HeapSetInformation
RtlUnwind
LCMapStringW
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLocaleInfoW
GetTimeZoneInformation
HeapSize
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
LoadLibraryW
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringW
CreateToolhelp32Snapshot
MultiByteToWideChar
SetEvent
WaitForSingleObject
CloseHandle
CreateEventA
GetTimeFormatA
Sleep
GetModuleFileNameA
GetSystemTimeAsFileTime
GetLastError
WideCharToMultiByte
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetDateFormatA

advapi32

CloseServiceHandle
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ControlService
QueryServiceStatusEx
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW

shlwapi

SHDeleteKeyW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

Sections

.text
Size: 404KB - Virtual size: 403KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89605709f09fdd0bc008de2aff3d7c3a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shlwapi

shell32

Sections

.text Size: 404KB - Virtual size: 403KB

.rdata Size: 77KB - Virtual size: 77KB

.data Size: 27KB - Virtual size: 37KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 35KB - Virtual size: 35KB

.text
Size: 404KB - Virtual size: 403KB

.rdata
Size: 77KB - Virtual size: 77KB

.data
Size: 27KB - Virtual size: 37KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 35KB - Virtual size: 35KB