2024-04-22_38984c92076a2c296ce472822741e5b3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-22_38984c92076a2c296ce472822741e5b3_mafia
Size

361KB
MD5

38984c92076a2c296ce472822741e5b3
SHA1

d8ffbfb13b42120078d92731bcbc19e095f859cd
SHA256

800c46e5956041c193f8af081cd3e426ced9f4132e18ded2d163847cee7a0c09
SHA512

c8a5939a52a04e9b3f96ddbcd1dedc33c30041a95568c3c2ea3b6f7745f366ba07e23624deabd540650cdeec53d667cfe91419a5096f4bfeda842a2fcb41c34c
SSDEEP

6144:S4YFrCrhAlnhGnO+opJds0i3w64ntiLco:SRFrQ4nwnO+iJrDtigo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-22_38984c92076a2c296ce472822741e5b3_mafia

Files

2024-04-22_38984c92076a2c296ce472822741e5b3_mafia
.exe windows:5 windows x86 arch:x86

68b34b690a51c15c0d0432c70cb249ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\_projekty\Various\ProfesalMAPI\Release\ProfesalMAPI.pdb

Imports

advapi32

RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

kernel32

OpenFile
FreeLibrary
HeapAlloc
VerSetConditionMask
HeapFree
GetUserDefaultLCID
GetSystemDefaultLCID
GetModuleHandleW
GetProcessHeap
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
VerifyVersionInfoW
GetLastError
GetProcAddress
GetPrivateProfileStringA
LoadLibraryA
GetShortPathNameW
ExpandEnvironmentStringsW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLocaleInfoW
GetCPInfo
GetCommandLineW
HeapSetInformation
RaiseException
RtlUnwind
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
HeapCreate
ExitProcess
WriteFile
GetModuleFileNameW
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
GetTimeZoneInformation
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
SetEnvironmentVariableA

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

68b34b690a51c15c0d0432c70cb249ce

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

Sections

.text Size: 224KB - Virtual size: 223KB

.rdata Size: 33KB - Virtual size: 33KB

.data Size: 9KB - Virtual size: 17KB

.rsrc Size: 78KB - Virtual size: 78KB

.reloc Size: 14KB - Virtual size: 14KB

.text
Size: 224KB - Virtual size: 223KB

.rdata
Size: 33KB - Virtual size: 33KB

.data
Size: 9KB - Virtual size: 17KB

.rsrc
Size: 78KB - Virtual size: 78KB

.reloc
Size: 14KB - Virtual size: 14KB