2024-04-23_16e3f60deeb43290ff8f437477652666_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-23_16e3f60deeb43290ff8f437477652666_mafia
Size

276KB
MD5

16e3f60deeb43290ff8f437477652666
SHA1

fa1a9e00d0492a0123c087bb4ad56eb855419ae9
SHA256

60d2e7ea12934e956b10237b23ffe550a503275305dd9200b8aae243ef6afa41
SHA512

6b06be3d4141108ce88a288341dbdcddfe9267fe92cbe049cd49678d78fec1d152e1d7ce74b196d93598150b803f9c4164bf1d48bb509b2e17885ba2c5f1e752
SSDEEP

6144:JJzizSklbQsC0VWXwPRZh2jNqOfZGjROh7qd:JJ0xBQsrWX4Lh2jN3fZqAq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-23_16e3f60deeb43290ff8f437477652666_mafia

Files

2024-04-23_16e3f60deeb43290ff8f437477652666_mafia
.exe windows:5 windows x86 arch:x86

774ead2d84bd5619e0e62194c2a94e17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ras-jaruney\fuhawagiguh56\gucagat97_tuyaciz86-refehizo.pdb

Imports

kernel32

GetDriveTypeW
GetModuleHandleW
GetSystemDirectoryA
GetCommandLineA
SetEnvironmentVariableW
GetFirmwareEnvironmentVariableA
HeapUnlock
ReplaceFileA
EnumTimeFormatsA
GetVolumePathNamesForVolumeNameW
ReadConsoleW
GetProcAddress
LoadLibraryW
SetEvent
LocalAlloc
GlobalAlloc
GetLastError
GetOverlappedResult
WaitForSingleObject
WaitNamedPipeW
FormatMessageW
FindFirstVolumeMountPointA
SetTimerQueueTimer
WaitForMultipleObjectsEx
WriteConsoleOutputW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CloseHandle
RaiseException
IsProcessorFeaturePresent
ExpandEnvironmentStringsW
WriteConsoleW
SetStdHandle
HeapAlloc
ExitProcess
DecodePointer
HeapSetInformation
GetStartupInfoW
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
EncodePointer
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
SetHandleCount
GetFileType
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
RtlUnwind
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
LCMapStringW
GetStringTypeW
FlushFileBuffers
ReadFile
CreateFileW

user32

ClipCursor
GetMessageExtraInfo
GetScrollBarInfo
RedrawWindow
GetWindowRgn

gdi32

TranslateCharsetInfo

msimg32

GradientFill

Sections

.text
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

774ead2d84bd5619e0e62194c2a94e17

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

Sections

.text Size: 178KB - Virtual size: 177KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 127KB

.rsrc Size: 70KB - Virtual size: 69KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 178KB - Virtual size: 177KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 127KB

.rsrc
Size: 70KB - Virtual size: 69KB

.reloc
Size: 5KB - Virtual size: 4KB