2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia

General

Target
2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia
Size 316KB
Sample240324-emxcsshe46
SHA256 5bb7b26742b514a18cd6ed6f4f3c775465732ff21bfd119f138899b062d24cec
MD5 9177db398121ec0cb5a27908ac857d49
SHA1 1edf8179a9df49cba8fdbe25e988527ed308fb35
SHA512 274908d33cb139dc076bbaab4c60ec1c02103c06caf22e629b5bb94792cd25ca01b43362dc64a165cc555c12347414bb3df54e6dff51ce73c373f48fd4fcd2b7
SSDEEP 6144:/vjA0MO1UnseVgkV0xwvfxnhLTiusLe1740B:zbM0Unsna5mut40B
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia

File Explorer

2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia

.exe 316KB

2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia

IMPHASH c1a7cd492f8081347598067bc439debf
SHA256 5bb7b26742b514a18cd6ed6f4f3c775465732ff21bfd119f138899b062d24cec
MD5 9177db398121ec0cb5a27908ac857d49
SHA1 1edf8179a9df49cba8fdbe25e988527ed308fb35
SHA512 274908d33cb139dc076bbaab4c60ec1c02103c06caf22e629b5bb94792cd25ca01b43362dc64a165cc555c12347414bb3df54e6dff51ce73c373f48fd4fcd2b7
SSDEEP 6144:/vjA0MO1UnseVgkV0xwvfxnhLTiusLe1740B:zbM0Unsna5mut40B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

24237

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AddConsoleAliasW LoadLibraryW GetTapePosition GetLastError VirtualAlloc FindFirstVolumeMountPointW lstrlenA CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer CloseHandle PulseEvent HeapReAlloc IsValidLocale WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineA HeapSetInformation GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThreadId GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW GetLocaleInfoW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA FlushFileBuffers

user32

RemoveMenu SetMenuInfo PostMessageW CreateCursor GetWindowTextLengthA DrawEdge SetWindowsHookW

advapi32

ReportEventW

ole32

CoReleaseMarshalData CreateStreamOnHGlobal

Name

.text

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

55.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.htext

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-24_9177db398121ec0cb5a27908ac857d49_mafia

kernel32

user32

advapi32

ole32

generic