2024-04-19_7023b9ddd493cb8bfaae36a27dead1ed_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-19_7023b9ddd493cb8bfaae36a27dead1ed_mafia
Size

426KB
MD5

7023b9ddd493cb8bfaae36a27dead1ed
SHA1

8d992b6e3fed294af44c64db71c2a45ce17ad6c1
SHA256

0f5d494759cedbb3b0a6542c2d7d75bfb31eaa1ff7507fcf4d14bc6c8391cfe6
SHA512

b48b03c6a75dbd2b0036aa860dc74f6be2f92d871a358f49a3b2ea1bf9811104b31de72a82159e3530d8bcc5e95075e2cd74ae0a706c15f12e01d629538005e8
SSDEEP

12288:rBSTky9rnn8gJhpNv7jqN3J0NMDjLa+H+jrq:r09rn8+hphHqSojLam

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-19_7023b9ddd493cb8bfaae36a27dead1ed_mafia

Files

2024-04-19_7023b9ddd493cb8bfaae36a27dead1ed_mafia
.exe windows:5 windows x86 arch:x86

59dca6009e9f354251a1bbff885bd426

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wtsapi32

WTSQueryUserToken
WTSEnumerateSessionsW

kernel32

SizeofResource
MultiByteToWideChar
LockResource
GetWindowsDirectoryW
GetVolumeInformationW
WideCharToMultiByte
Process32FirstW
Module32FirstW
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
LoadLibraryW
GetProcAddress
LoadLibraryA
LoadResource
LoadLibraryExW
GetTickCount
GetLastError
CreateEventW
CreateThread
CreateProcessW
WaitForSingleObject
Sleep
GetTempFileNameA
FindClose
FindNextFileW
DeleteFileW
WriteConsoleW
SetStdHandle
FindResourceW
FindResourceExW
FlushFileBuffers
CreateFileW
LoadLibraryExA
HeapFree
GetConsoleMode
GetConsoleCP
SetFilePointer
SetConsoleCtrlHandler
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
ExitThread
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
FreeLibrary
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeW
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA

user32

wsprintfW

advapi32

StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerExW
ChangeServiceConfig2W
CloseServiceHandle
GetTokenInformation

ole32

StringFromGUID2
CoCreateGuid

wininet

InternetReadFile

winhttp

WinHttpCrackUrl

Sections

.text
Size: 341KB - Virtual size: 341KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

59dca6009e9f354251a1bbff885bd426

Headers

DLL Characteristics

File Characteristics

Imports

wtsapi32

kernel32

user32

advapi32

ole32

wininet

winhttp

Sections

.text Size: 341KB - Virtual size: 341KB

.rdata Size: 58KB - Virtual size: 58KB

.data Size: 6KB - Virtual size: 17KB

.reloc Size: 18KB - Virtual size: 18KB

.text
Size: 341KB - Virtual size: 341KB

.rdata
Size: 58KB - Virtual size: 58KB

.data
Size: 6KB - Virtual size: 17KB

.reloc
Size: 18KB - Virtual size: 18KB