E:\pre_i18_per_to_202007_061\Build\Release\WPSOffice\wtoolex\updateself.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_4dda4afeacb4fce3b82836721f652ab3_mafia.exe
Resource
win7-20240220-en
General
-
Target
2024-03-19_4dda4afeacb4fce3b82836721f652ab3_mafia
-
Size
1.3MB
-
MD5
4dda4afeacb4fce3b82836721f652ab3
-
SHA1
d88c9eabb38d9d80169974818f4bd37a507f6187
-
SHA256
c4651a3e8347e89359c9ba7abb8de69bdfda78ccb9a912de77f3acfc5924bd13
-
SHA512
5b28311d7ea6e7aa51262b3e6ce0f5f81bc731fae14b2760d17459ab0f563de4025691b9b3f07b08385bbc12a1770949295178a8e0cef2325da281a5f18acef4
-
SSDEEP
24576:q6cDtdda81uqgma9kf2M9jRFEM4XlhafCLTvt2rR8FfBhRJUEbDk1ulUX:qTtTa81ugMMulFnvt2r4PRSEk1ul
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-19_4dda4afeacb4fce3b82836721f652ab3_mafia
Files
-
2024-03-19_4dda4afeacb4fce3b82836721f652ab3_mafia.exe windows:5 windows x86 arch:x86
5df414f973933ae88231b7b412f6e16d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
GetCurrentThread
CloseHandle
GetLastError
GetVersionExW
SetLastError
InterlockedDecrement
LocalFree
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetProcAddress
LoadLibraryW
GetDateFormatW
GetTimeFormatW
GetVersion
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrlenW
OpenProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetFileAttributesW
GetUserDefaultLCID
IsWow64Process
GetCommandLineW
lstrlenA
Sleep
ExpandEnvironmentStringsW
DeleteFileW
FindClose
GetModuleHandleW
GetModuleFileNameW
RemoveDirectoryW
FindNextFileW
MoveFileExW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GlobalFree
WaitForSingleObject
WriteFile
CreateFileW
GetModuleHandleA
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
GetExitCodeProcess
CopyFileW
CreateEventW
ResetEvent
SetEvent
ResumeThread
InterlockedExchange
SetFilePointer
GetTickCount
ReadFile
MoveFileW
GetExitCodeThread
CreateThread
GetFileAttributesExW
ReleaseMutex
OutputDebugStringW
GetCurrentThreadId
GetFileSize
CreateMutexW
SetFileAttributesW
GetPrivateProfileSectionW
LocalAlloc
RaiseException
GetUserDefaultUILanguage
DeviceIoControl
CreateFileA
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
SleepEx
QueryPerformanceCounter
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FormatMessageA
GetSystemTime
InterlockedIncrement
GetStringTypeW
InterlockedCompareExchange
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindFirstFileExW
GetDriveTypeA
ExitThread
GetFileInformationByHandle
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetDriveTypeW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
Sections
.text Size: 538KB - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 604KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE