2024-03-26_9bc5487983e0905333f3af87bec24f83_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-26_9bc5487983e0905333f3af87bec24f83_mafia
Size

458KB
MD5

9bc5487983e0905333f3af87bec24f83
SHA1

96f1d29a5b91310843dbb3bad5239aaca6577abd
SHA256

892d02db50bcd3c236e3573f0773a1970ff8f0c2b5154dd04d088b4782cf0e40
SHA512

b50734d9e405175d1ac8fda1d7ecd30271ddd918fd32daf175e4ed2065fe3b2d889143d7378ad10d6ebf3db65b757dbb2b90e3e6000f0f6892f4c2098d671814
SSDEEP

12288:pkIxQOI/LczbI8bREaLxs17qFPk1Gd1/nhieFRfRIiON:mpTcw8bfFPR/vhTFR+d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-26_9bc5487983e0905333f3af87bec24f83_mafia

Files

2024-03-26_9bc5487983e0905333f3af87bec24f83_mafia
.exe windows:5 windows x86 arch:x86

8df8698a93e480d9684d5f4c7ce45ae9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEvent
WaitForMultipleObjects
CreateFileW
GetFileSize
CreateEventW
CreateThread
WaitForSingleObject
CloseHandle
Sleep
GetLastError
GetUserDefaultLangID
GetModuleFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
SetEndOfFile
GetDriveTypeW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetTickCount
SleepEx
GetVersionExA
FormatMessageA
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
InterlockedCompareExchange
InterlockedExchange
EncodePointer
DecodePointer
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapReAlloc
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileExA
LCMapStringW
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapSize
ExitProcess
HeapCreate
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetLocaleInfoW
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
FlushFileBuffers
GetFullPathNameA
CreateFileA
GetCurrentDirectoryW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
WriteConsoleW
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA

user32

GetActiveWindow
MessageBoxA

advapi32

CryptDestroyHash
CryptAcquireContextA
CryptHashData
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
StartServiceW
CryptGetHashParam
CryptCreateHash
CryptReleaseContext

shell32

ShellExecuteW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

socket
closesocket
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
connect

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200
ord33
ord301
ord27
ord41
ord46

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 374KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8df8698a93e480d9684d5f4c7ce45ae9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

version

ws2_32

wldap32

Exports

Exports

Sections

.text Size: 374KB - Virtual size: 374KB

.rdata Size: 57KB - Virtual size: 57KB

.data Size: 7KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 374KB - Virtual size: 374KB

.rdata
Size: 57KB - Virtual size: 57KB

.data
Size: 7KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 18KB - Virtual size: 17KB