2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia

General

Target
2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia
Size 323KB
Sample240322-f8kfsshc25
SHA256 78dabb1a63279015b94c699a1a0b617baf98465a9dd6f796f4a038e545df4d93
MD5 e1ca8496cdcff6507b2c808c9fe463ce
SHA1 18b86c9c8ca37582beeea8dc02b0e0b0e353164c
SHA512 575fd538cb41aa33cdb0b5fb3485ec404c9ea3fe0ede28a3297183d54e4fc3a856977443dc794f2f3bdec8bc03fdf4673c8712f1daab3fde41abafca4b2e7026
SSDEEP 3072:OLXtoITs8+GgzXKhp6vFcBNTjbL617AL6MfUL1OeV7LGyH0Bme3BdcpFbMT99:OLX1Yz7z6hp2W1L61ALCOk7LhdeROu9
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia

File Explorer

2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia

.exe 323KB

2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia

IMPHASH 25f3201f91b69b7c57f516ad4f680a58
SHA256 78dabb1a63279015b94c699a1a0b617baf98465a9dd6f796f4a038e545df4d93
MD5 e1ca8496cdcff6507b2c808c9fe463ce
SHA1 18b86c9c8ca37582beeea8dc02b0e0b0e353164c
SHA512 575fd538cb41aa33cdb0b5fb3485ec404c9ea3fe0ede28a3297183d54e4fc3a856977443dc794f2f3bdec8bc03fdf4673c8712f1daab3fde41abafca4b2e7026
SSDEEP 3072:OLXtoITs8+GgzXKhp6vFcBNTjbL617AL6MfUL1OeV7LGyH0Bme3BdcpFbMT99:OLX1Yz7z6hp2W1L61ALCOk7LhdeROu9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetSystemTimes lstrlenW VirtualAlloc PrepareTape LoadLibraryA FindFirstVolumeMountPointW AddConsoleAliasA GetThreadTimes lstrlenA CloseHandle CreateFileW WriteConsoleW SetStdHandle LoadLibraryW GetConsoleMode GetConsoleCP SetFilePointer PulseEvent WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc FlushFileBuffers

user32

PostMessageW DeleteMenu GetWindowTextLengthA DrawEdge DestroyCursor SetWindowsHookW SetMenuInfo RemoveMenu

advapi32

ReportEventA

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

71.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-22_e1ca8496cdcff6507b2c808c9fe463ce_mafia

kernel32

user32

advapi32

generic