2024-04-10_1f70754e3a1882c3c21c6f2ea588b700_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-10_1f70754e3a1882c3c21c6f2ea588b700_mafia
Size

300KB
MD5

1f70754e3a1882c3c21c6f2ea588b700
SHA1

7fae7a9a1cc010743117f978d081b4cd259a691d
SHA256

179e2af9f75b218ded8c48ce318a529996bb9880248bfbe23a883362c3c0e667
SHA512

6799b7b07e741f92a2f3cdbe584c4fb747e48ba1c5e2060daf8135efdf08a148c24da53e1f247ee93d74eb352772f55526bb220bc2734507366132f3e0199dcf
SSDEEP

6144:SXpV4gvEIRarW46bDX+zgDfb91nHjCYoRd:S5V1v7Irf6fX7DfbjnDCP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_1f70754e3a1882c3c21c6f2ea588b700_mafia

Files

2024-04-10_1f70754e3a1882c3c21c6f2ea588b700_mafia
.exe windows:5 windows x86 arch:x86

69218537eeee32597ce3c5f3be0c625a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\swbuilder\FARM\Builds\ram-test-installers\Src\util\adminExec.pdb

Imports

advapi32

CreateProcessWithLogonW

kernel32

FormatMessageW
GetLastError
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetComputerNameExW
GetVersionExW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
HeapSetInformation
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetCurrentThread
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
CloseHandle
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
WriteConsoleW
SetStdHandle
CreateFileW

Sections

.text
Size: 241KB - Virtual size: 241KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

69218537eeee32597ce3c5f3be0c625a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

Sections

.text Size: 241KB - Virtual size: 241KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 8KB - Virtual size: 17KB

.idata Size: 3KB - Virtual size: 2KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 241KB - Virtual size: 241KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 8KB - Virtual size: 17KB

.idata
Size: 3KB - Virtual size: 2KB

.reloc
Size: 10KB - Virtual size: 9KB