2024-03-13_43a921f89cef249ab663633bbc741f82_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-13_43a921f89cef249ab663633bbc741f82_mafia
Size

6.1MB
MD5

43a921f89cef249ab663633bbc741f82
SHA1

5de1d8501524a74e182c9633984c8bf91d750622
SHA256

d2ccd32d90717efd9c6ded73ccf0c96134f258752a2e6ec198ea3de0aa7f8aa3
SHA512

8fac6c1366c75b51b993a04f3a0700569795924bec8113b215a322c14d87a869f2d0dffc793dd911a698ae13e73d90ab64370342f2ed8995ff84d18cbf734625
SSDEEP

98304:bihyoPgbIAQEHY3N3sNfxLlC1DxeGqrEr:aDRsNZUDxeN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-13_43a921f89cef249ab663633bbc741f82_mafia

Files

2024-03-13_43a921f89cef249ab663633bbc741f82_mafia
.exe windows:5 windows x86 arch:x86

f4802c29b7068dbc83b8d72daafaa11f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Cristy\ImageMagick-6.8.6\VisualMagick\bin\convert.pdb

Imports

vcomp100

_vcomp_single_end
_vcomp_single_begin
_vcomp_master_begin
_vcomp_master_end
_vcomp_enter_critsect
_vcomp_leave_critsect
omp_get_thread_num
omp_get_max_threads
_vcomp_fork
_vcomp_set_num_threads
_vcomp_for_static_init
omp_set_num_threads
omp_set_nested
_vcomp_for_static_simple_init
_vcomp_for_static_end
_vcomp_barrier

kernel32

WideCharToMultiByte
FindClose
FreeLibrary
SetConsoleCtrlHandler
SystemTimeToFileTime
GetSystemTime
GetModuleFileNameA
LocalFree
FormatMessageA
GetLastError
GetProcAddress
GetModuleHandleA
IsWow64Process
GetCurrentProcess
CloseHandle
MapViewOfFile
CreateFileMappingA
FindFirstFileA
LoadLibraryExA
SetErrorMode
FindNextFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
FlushViewOfFile
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GlobalMemoryStatus
GetSystemInfo
SetEndOfFile
SetFilePointer
UnmapViewOfFile
GetProcessTimes
TerminateProcess
GetCurrentThreadId
OutputDebugStringA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLogicalDrives
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCommandLineW
HeapSetInformation
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
GetFileType
CreateFileW
GetCurrentDirectoryA
GetConsoleCP
GetConsoleMode
ReadFile
GetTimeZoneInformation
GetVersionExA
GetCurrentProcessId
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetDriveTypeW
GetFullPathNameA
GetFileAttributesW
MoveFileW
DeleteFileW
FindFirstFileExW
InterlockedDecrement
InterlockedIncrement
CreateProcessW
DuplicateHandle
FlushFileBuffers
RtlUnwind
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
DeleteFileA
SetLastError
GetCurrentThread
HeapCreate
HeapDestroy
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
LoadLibraryW
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
HeapQueryInformation
GetProcessHeap
WriteConsoleW
LCMapStringW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
RaiseException
CreatePipe
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
CreateFileA
SetEnvironmentVariableW
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
MultiByteToWideChar
SetCurrentDirectoryA
InterlockedExchange
InterlockedCompareExchange
Sleep
GetDriveTypeA
FindFirstFileExA
ExitThread
ResumeThread
SetStdHandle
CreateThread
WriteFile
TlsFree
LoadLibraryA
GetSystemDirectoryA
CreateMutexA
ReleaseMutex
InitializeCriticalSection
lstrlenA

user32

MessageBoxA
EmptyClipboard
SetClipboardData
OpenClipboard
ReleaseDC
GetDC
CloseClipboard
GetClipboardData

gdi32

CreateCompatibleDC
GetObjectA
CreateDIBSection
DeleteObject
DeleteDC
SelectPalette
RealizePalette
BitBlt
CreateBitmapIndirect
SelectObject

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumValueA

oleaut32

SafeArrayUnaccessData
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData

wsock32

ioctlsocket
WSAGetLastError
gethostbyname
inet_addr
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
WSACleanup
closesocket
select
send
recv
getsockopt
__WSAFDIsSet
connect
inet_ntoa
socket
WSAStartup
listen
bind
getsockname

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 295KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 724KB - Virtual size: 728KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4802c29b7068dbc83b8d72daafaa11f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcomp100

kernel32

user32

gdi32

advapi32

oleaut32

wsock32

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 295KB - Virtual size: 462KB

.rsrc Size: 190KB - Virtual size: 189KB

.reloc Size: 724KB - Virtual size: 728KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 295KB - Virtual size: 462KB

.rsrc
Size: 190KB - Virtual size: 189KB

.reloc
Size: 724KB - Virtual size: 728KB