2024-03-13_92c748ac55536521f267f8507f5d7587_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-13_92c748ac55536521f267f8507f5d7587_mafia
Size

2.6MB
MD5

92c748ac55536521f267f8507f5d7587
SHA1

965a3fddfe519f1103aa83070ed6e105f5d4652b
SHA256

0186fccc44fc703ad24320f819f2b57935fde5b08b4be05fc47a05021dae0684
SHA512

15d8f74229f969debde8e1ef0932c06a28a2f3dadefaad3b71c9b06274058e121defbdde26bbfc820bc1df92978b064834f1688ffcc6747b67a88786e418aa61
SSDEEP

24576:BxtpYJ42npqDfIXD7BKCALD99tiN+XT+WdoNYFPmo4myTvOETMy8N81VpMqyuiO1:BxUqEXILrtiNErFeojyTvO9V3Ixn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-13_92c748ac55536521f267f8507f5d7587_mafia

Files

2024-03-13_92c748ac55536521f267f8507f5d7587_mafia
.exe windows:5 windows x86 arch:x86

633f16ebfbadb222a58488128c9fad9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Public\Dev\horizon\Utility\UpdaterEngine\Release\UpdaterEngine.pdb

Imports

kernel32

CreateThread
FreeLibrary
GetProcAddress
LoadLibraryA
SetCurrentDirectoryA
GetModuleFileNameA
GetCurrentDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
IsValidLocale
WaitForSingleObject
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetTimeZoneInformation
GetCurrentProcessId
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
HeapSize
FlushFileBuffers
GetModuleFileNameW
HeapCreate
CloseHandle
MoveFileA
MulDiv
SizeofResource
GetTempPathA
CopyFileA
MoveFileExA
FindFirstFileA
GetLastError
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
MultiByteToWideChar
FindResourceA
LoadResource
LockResource
EnumSystemLocalesA
CreateDirectoryA
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetFileType
GetStdHandle
SetHandleCount
InitializeCriticalSectionAndSpinCount
ReadFile
SetFilePointer
GetProcessHeap
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleMode
GetConsoleCP
WriteFile
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
HeapReAlloc
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetSystemTimeAsFileTime

user32

MessageBoxA
EndDialog
SetTimer
DialogBoxParamA
KillTimer
TranslateMessage
DispatchMessageA
PeekMessageA
MoveWindow
ScreenToClient
EnableWindow
OffsetRect
PostQuitMessage
ShowWindow
LoadIconA
SetWindowLongA
OemToCharA
GetWindowRect
SendMessageA
GetDlgItem
CreateDialogParamA
GetMessageA
GetDlgItemTextA
GetClientRect
SendDlgItemMessageA
wsprintfA
GetDC

gdi32

CreateFontA
SelectObject
SetBkMode
GetTextExtentPoint32A
TextOutA
StretchDIBits
DeleteObject
CreateSolidBrush
SetBkColor
SetTextColor
GetDeviceCaps

advapi32

RegDeleteValueA
RegOpenKeyExA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegSetValueA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA

shell32

ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderPathA

ole32

CoInitialize
CoCreateInstance
CoUninitialize

wsock32

ntohl
htonl
ntohs
socket
WSAStartup
WSACleanup
ioctlsocket
gethostbyaddr
gethostbyname
send
__WSAFDIsSet
select
WSAGetLastError
connect
closesocket
shutdown
inet_ntoa
htons
recv

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 846KB - Virtual size: 846KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 289KB - Virtual size: 289KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

633f16ebfbadb222a58488128c9fad9f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

wsock32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 846KB - Virtual size: 846KB

.data Size: 44KB - Virtual size: 54KB

.rsrc Size: 289KB - Virtual size: 289KB

.reloc Size: 65KB - Virtual size: 65KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 846KB - Virtual size: 846KB

.data
Size: 44KB - Virtual size: 54KB

.rsrc
Size: 289KB - Virtual size: 289KB

.reloc
Size: 65KB - Virtual size: 65KB