2024-03-25_e89ff7500fc66041ef8f38b8a540dbea_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-25_e89ff7500fc66041ef8f38b8a540dbea_mafia
Size

220KB
MD5

e89ff7500fc66041ef8f38b8a540dbea
SHA1

71cff11b20fc7233e9118519a9bc3457864004b5
SHA256

f0e301dacada45b2df0079f90f04f8b0229fa081618b3f039ada1a585c4af0ef
SHA512

f652175952fb77e93bf2c6338f2e43b2e1ccefdaa108d7c8567cc662b9cae5356ec28f8cac3d0251f179ce7f34ecc06e7a1f411ac4987a8db0d2f37e464223ca
SSDEEP

3072:mqSIvM8ki8N7paWeEadWEpYafpSfQFb/u69pliOX:9TMrnF4WE7b/79pR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-25_e89ff7500fc66041ef8f38b8a540dbea_mafia

Files

2024-03-25_e89ff7500fc66041ef8f38b8a540dbea_mafia
.exe windows:5 windows x86 arch:x86

6fc6f038d8b9d52675f50939c2a3c25e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\mcci+ReleaseWin32_6-11-1_release\mcci\McciContext\McciContextHookShim\SourceCode\Win32\Release\pcContextHookShim.pdb

Imports

kernel32

IsBadCodePtr
SuspendThread
ResumeThread
GetCurrentThread
ResetEvent
CreateEventA
TerminateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
PulseEvent
ReleaseMutex
CreateMutexA
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryA
LeaveCriticalSection
CompareStringW
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
LCMapStringW
LoadLibraryW
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetWindowsDirectoryA
Sleep
GetTickCount
GetCurrentThreadId
GetModuleFileNameA
GetCurrentProcessId
OutputDebugStringA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
CloseHandle
GetVersionExA
GetModuleHandleA
GetACP
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FindResourceExW
GetLastError
FindResourceW
LoadResource
LockResource
SizeofResource
EnterCriticalSection
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetCPInfo
RaiseException
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetCommandLineA
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsProcessorFeaturePresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
SetEnvironmentVariableA

user32

LoadIconA
UpdateWindow
ShowWindow
LoadStringA
GetMessageA
TranslateMessage
DispatchMessageA
GetFocus
LoadCursorA
RegisterClassExA
DefWindowProcA
PostQuitMessage
CreateWindowExA

advapi32

RegOpenKeyExW
RegQueryValueExW
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
GetUserNameA

shell32

SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CoInitialize
CoUninitialize

shlwapi

PathAppendW
PathFileExistsA
PathStripPathW
PathAddBackslashW

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6fc6f038d8b9d52675f50939c2a3c25e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

Sections

.text Size: 115KB - Virtual size: 114KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 115KB - Virtual size: 114KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 14KB - Virtual size: 14KB