2024-04-20_db252e26eccf2bb7f8e408c3df5e6eca_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-20_db252e26eccf2bb7f8e408c3df5e6eca_mafia
Size

1.4MB
MD5

db252e26eccf2bb7f8e408c3df5e6eca
SHA1

6000ce32172f980eb52a953299125da51f65c359
SHA256

d13d558d480d8aaa678bac01ea5dacb93cea7125a3382e135d4e541a4653fde9
SHA512

27d61f448bb29360ef14feb3dca1863b634c0454423c661309cabb2e2356fb20d498232940ab870f4b1192a0b857225b2a2718150702a361f249e9f85a15dde4
SSDEEP

24576:afC+HW38Ihybx/yolqaEXQfLAKHN9RFvFytL7lZysd3D1RjKq9hT3XZe7+K:0OByPlqa/fcmNvWTZZxRRjf3TqX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-20_db252e26eccf2bb7f8e408c3df5e6eca_mafia

Files

2024-04-20_db252e26eccf2bb7f8e408c3df5e6eca_mafia
.exe windows:5 windows x86 arch:x86

0c4347a1f17b67dca60d6ed0883efee4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharLowerA

advapi32

GetUserNameA

shell32

CommandLineToArgvW

kernel32

HeapSize
CreatePipe
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
WriteConsoleW
GetStdHandle
GetCommandLineW
ReadConsoleW
FindFirstFileA
FindNextFileA
FindClose
SearchPathA
GetOEMCP
GetACP
AreFileApisANSI
GetVersion
GetExitCodeProcess
FindNextFileW
FindFirstFileW
GetLastError
GetFileAttributesW
GetFileAttributesA
ExitProcess
GetFileType
GetModuleFileNameW
HeapFree
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetSystemTimeAsFileTime
HeapAlloc
GetProcAddress
GetModuleHandleW
DecodePointer
HeapReAlloc
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
GetModuleFileNameA
GetCommandLineA
HeapSetInformation
CloseHandle
CreateProcessW
DuplicateHandle
GetCurrentProcess
GetDriveTypeW
GetFullPathNameA
CreateFileA
CreateProcessA
ReadFile
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
LoadLibraryW
HeapCreate
GetCPInfo
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
IsProcessorFeaturePresent
RaiseException
SetFilePointer
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
Sleep
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
WriteFile
SetStdHandle
GetTimeZoneInformation
GetConsoleCP
FlushFileBuffers
CreateFileW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringW
SetEndOfFile
GetProcessHeap
WaitForSingleObject
SetEnvironmentVariableW
SetEnvironmentVariableA
GetStringTypeW

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 155KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c4347a1f17b67dca60d6ed0883efee4

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

shell32

kernel32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 155KB - Virtual size: 291KB

.reloc Size: 44KB - Virtual size: 43KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 155KB - Virtual size: 291KB

.reloc
Size: 44KB - Virtual size: 43KB