D:\depot\_build\tc\SAPSetup\NWSapStp_09_REL\gen\dbg\java\sub\_nwsapsetup\e\01\src\OptU\ntintel\SapSmartDeleteFolder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-07_290ae0efdfe1f8a4e36fd04185735047_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-07_290ae0efdfe1f8a4e36fd04185735047_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-07_290ae0efdfe1f8a4e36fd04185735047_mafia
-
Size
368KB
-
MD5
290ae0efdfe1f8a4e36fd04185735047
-
SHA1
227e083f1f2d551756565841218ad6607b91d2b4
-
SHA256
201c1a5573c2b34ec90fe3cc183b46d60ca4456920434ddf79a35d2239b6adcd
-
SHA512
ed86f2441e2ad90bce528c1750ad1d2265a08a8b088445a718307dec5f19800258b4e6857471770fea3c450e5c126945edb669f881d6e7d4afd9e10a88edc470
-
SSDEEP
6144:Xhr7i0kY/c18CW2vs7NHciKicne1SCeiKoKIAy7raZ0deWQllmB:XF7i0P/c1VW2vsp8iKic3TiRK+6Z48OB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-07_290ae0efdfe1f8a4e36fd04185735047_mafia
Files
-
2024-05-07_290ae0efdfe1f8a4e36fd04185735047_mafia.exe windows:5 windows x86 arch:x86
ff8e0b244d977a4086e0973905f392eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
Sleep
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
FindClose
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
CopyFileW
MoveFileW
CreateFileW
FindFirstFileW
FindNextFileW
WriteFile
ReadFile
SetFilePointer
CreateDirectoryW
GetDriveTypeW
GetWindowsDirectoryW
GetNativeSystemInfo
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcAddress
FormatMessageW
LocalFree
GetFileInformationByHandle
InterlockedIncrement
InterlockedDecrement
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineW
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexW
GetCurrentProcessId
GlobalMemoryStatusEx
FlushFileBuffers
DeviceIoControl
LoadLibraryW
FreeLibrary
SetErrorMode
TerminateProcess
SetCurrentDirectoryW
GetCurrentThread
VirtualQuery
ReadProcessMemory
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapSetInformation
GetStartupInfoW
GetFullPathNameW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapReAlloc
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetVersionExW
LoadLibraryA
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrlenW
WideCharToMultiByte
InitializeCriticalSection
GetLastError
advapi32
RegCloseKey
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
shell32
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ