2024-04-17_4efd79c1776cca158dd3d5d3fc1185e8_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_4efd79c1776cca158dd3d5d3fc1185e8_mafia
Size

445KB
MD5

4efd79c1776cca158dd3d5d3fc1185e8
SHA1

a9235a2fdf36ec41ec4dc6b32b589b4a6faab2d2
SHA256

e02c5ce4815993e2a6fafd9e302e4aa748c9eeaf947085898dd8764f8fc34c63
SHA512

bd1751c856ca59511e0260eece4c78a4bc1b3003577fe39f2f4e7f58c9ff8c8fb32dd7e18e622053f4059e0dc78ea29361c3597f9108e43110f0c683a036ad3f
SSDEEP

12288:lKVP7vI5Azl9W92L+GJ6VLBtbBuCFkFUL/W:Al9W9O+GJ6Bt1uLULu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_4efd79c1776cca158dd3d5d3fc1185e8_mafia

Files

2024-04-17_4efd79c1776cca158dd3d5d3fc1185e8_mafia
.exe windows:5 windows x86 arch:x86

9e1ad97e57c13411cb6901572480f910

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\3-Workspace\UTMS_2.1\MprRasAdmin\XP - Release\MprRasConsoleXP.pdb

Imports

iphlpapi

CancelIPChangeNotify
NotifyRouteChange

kernel32

HeapSize
GetProcessHeap
QueueUserWorkItem
GetModuleFileNameW
HeapAlloc
CreateThread
WaitForSingleObject
GetTickCount
SetEvent
GetLastError
CreateEventW
SetCommState
GetCommConfig
GetCommState
CloseHandle
CreateFileW
LocalFree
Sleep
HeapFree
SetStdHandle
WriteConsoleW
LoadLibraryW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetConsoleCP
WriteFile
GetLocaleInfoW
ExitProcess
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsProcessorFeaturePresent
HeapCreate
GetProcAddress
GetCurrentThreadId
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
SetEndOfFile
GetOEMCP
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LCMapStringW
RtlUnwind
RaiseException
HeapSetInformation
GetStringTypeW
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetCPInfo
GetCommandLineW

advapi32

StartServiceCtrlDispatcherW
DeregisterEventSource
ControlService
QueryServiceStatus
ChangeServiceConfig2W
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegisterEventSourceW

rasapi32

RasGetSubEntryPropertiesW
RasGetEntryPropertiesW
RasDeleteSubEntryW
RasDeleteEntryW
RasSetSubEntryPropertiesW
RasSetEntryPropertiesW
RasValidateEntryNameW
RasEnumDevicesW
RasDialW
RasEnumConnectionsW
RasEnumEntriesW
RasGetConnectionStatistics
RasGetProjectionInfoW
RasGetConnectStatusW
RasHangUpW
RasGetErrorStringW
RasGetAutodialAddressW
RasGetEntryDialParamsW

mprapi

MprAdminConnectionGetInfo
MprAdminGetErrorString
MprAdminBufferFree
MprAdminDeviceEnum
MprAdminPortGetInfo
MprAdminPortDisconnect
MprAdminPortReset
MprAdminPortEnum
MprAdminConnectionEnum
MprAdminInterfaceDisconnect
MprAdminInterfaceConnect
MprAdminInterfaceCreate
MprAdminInterfaceDelete
MprAdminInterfaceEnum
MprAdminServerDisconnect
MprAdminServerConnect

ws2_32

WSAStartup
WSACleanup
socket
ioctlsocket
setsockopt
closesocket
htons
listen
accept
WSAGetLastError
send
recv
inet_addr
connect
bind

rpcrt4

UuidToStringW
RpcStringFreeW

Sections

.text
Size: 350KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9e1ad97e57c13411cb6901572480f910

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

kernel32

advapi32

rasapi32

mprapi

ws2_32

rpcrt4

Sections

.text Size: 350KB - Virtual size: 349KB

.rdata Size: 59KB - Virtual size: 58KB

.data Size: 10KB - Virtual size: 19KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 350KB - Virtual size: 349KB

.rdata
Size: 59KB - Virtual size: 58KB

.data
Size: 10KB - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 24KB - Virtual size: 24KB