p:\p\agents\hpam2.eem\recipes\201152726\base\branches\inputtools_win_release_branch\googleclient\ime\goopy\scons-out\opt\obj\installer\uninstaller_unsigned.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-22_716e3273dc134852bdc1b7253b9f11b8_mafia.exe
Resource
win7-20240220-en
General
-
Target
2024-04-22_716e3273dc134852bdc1b7253b9f11b8_mafia
-
Size
1.3MB
-
MD5
716e3273dc134852bdc1b7253b9f11b8
-
SHA1
f8d58146a3603dade910dc9d68838249a3c6468a
-
SHA256
2a3a106c6ee390e7b5dc646dbf1f25f3f9c263ccc1d7004e3904de9bb1b46c2c
-
SHA512
379335bf1e5294c45e2db2dcd8ae9e5dfef1c9f6d4fb5bcd1387c28deef086b9689187d993d596eb8f0f43eec603a38b94f84e85fc632f895253338feec8229b
-
SSDEEP
24576:7/0JmbJwh0nXkrjE9qLKjDNxHT3cxLU4IBemN6fIHq47hXgTmIo/phP3+7f:7/0Jmn2jE9qLKfNxHT3cxLjLmNeeZlXu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-22_716e3273dc134852bdc1b7253b9f11b8_mafia
Files
-
2024-04-22_716e3273dc134852bdc1b7253b9f11b8_mafia.exe windows:5 windows x86 arch:x86
41bb0c1d45e9ec282f51a2cfb66f3199
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetUserDefaultUILanguage
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WaitForSingleObject
OpenProcess
GetCommandLineW
CloseHandle
CreateProcessW
GetCurrentProcessId
InitializeCriticalSection
GlobalAlloc
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
LocalFree
GetFileAttributesW
GetLastError
GetModuleHandleW
GetProcAddress
FindFirstFileW
FindNextFileW
DeleteFileW
RemoveDirectoryW
FindClose
MultiByteToWideChar
GetVersionExW
GetCurrentProcess
CopyFileW
FreeLibrary
MoveFileExW
GetSystemWow64DirectoryW
TerminateProcess
GetExitCodeProcess
CreateFileW
WriteFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
OpenEventW
SetEvent
HeapAlloc
HeapFree
InterlockedCompareExchange
GetProcessHeap
GetFileSize
ReadFile
GetTickCount
GetModuleFileNameA
IsDebuggerPresent
GetCurrentThreadId
OutputDebugStringA
DebugBreak
GetTempPathA
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedExchange
EncodePointer
DecodePointer
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSetInformation
GetStartupInfoW
ExitProcess
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
GetStdHandle
GetLocaleInfoW
SetHandleCount
GetFileType
HeapCreate
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
QueryPerformanceCounter
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
WriteConsoleW
SetStdHandle
CreateFileA
SetEndOfFile
GetTempFileNameW
GetTempPathW
LoadLibraryW
GetModuleFileNameW
shlwapi
PathCombineW
PathFileExistsW
PathAppendW
user32
MessageBoxW
LoadStringW
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
advapi32
ControlService
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
EqualSid
GetTokenInformation
OpenProcessToken
FreeSid
AllocateAndInitializeSid
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
SHCreateDirectoryExW
SHGetFolderPathW
winmm
timeGetTime
Sections
.text Size: 593KB - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 608KB - Virtual size: 612KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE