2024-05-09_022ee3c8545edaf372a932fafc8d9b0a_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-09_022ee3c8545edaf372a932fafc8d9b0a_mafia
Size

5.5MB
MD5

022ee3c8545edaf372a932fafc8d9b0a
SHA1

3ba859326f77c5443f6b2080e894cb2a39bed897
SHA256

1a8baca1459853343e6eb82e1706128d238dc4efcdb5d9ccbe933151c74cbe42
SHA512

8cfdcb515270502f048c5bf2991baaf82d9d0f277c67f8b12e42e07f3d1a59f3459aabc3cf2080b67726daa6b69c509886835855a79ad2f5d3bc43973ae0e966
SSDEEP

49152:Bjkk15dyQfaNkmFxRQRvbXLjvl3u4Bgtyi7ULnaBvt6V9bJjnL0QMi5UT3fXB0As:Vt1DyQE0ShFllMB0yaSmzc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-09_022ee3c8545edaf372a932fafc8d9b0a_mafia

Files

2024-05-09_022ee3c8545edaf372a932fafc8d9b0a_mafia
.exe windows:5 windows x86 arch:x86

8bb51e7c524602c044cab41b4b24d32c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Cristy\ImageMagick-6.8.0\VisualMagick\bin\convert.pdb

Imports

vcomp100

_vcomp_single_end
_vcomp_single_begin
_vcomp_master_begin
_vcomp_master_end
_vcomp_enter_critsect
_vcomp_leave_critsect
omp_get_thread_num
omp_get_max_threads
_vcomp_fork
_vcomp_set_num_threads
_vcomp_for_static_init
_vcomp_for_static_simple_init
omp_set_num_threads
omp_set_nested
_vcomp_for_static_end
_vcomp_barrier

kernel32

WideCharToMultiByte
FindClose
FreeLibrary
SetConsoleCtrlHandler
SystemTimeToFileTime
GetSystemTime
GetModuleFileNameA
LocalFree
FormatMessageA
GetLastError
GetProcAddress
GetModuleHandleA
IsWow64Process
GetCurrentProcess
CloseHandle
MapViewOfFile
CreateFileMappingA
FindFirstFileA
LoadLibraryExA
SetErrorMode
FindNextFileA
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
FlushViewOfFile
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GlobalMemoryStatus
GetSystemInfo
SetEndOfFile
SetFilePointer
UnmapViewOfFile
GetProcessTimes
TerminateProcess
GetCurrentThreadId
OutputDebugStringA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetLogicalDrives
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetCommandLineW
HeapSetInformation
DecodePointer
EncodePointer
GetModuleHandleW
ExitProcess
HeapFree
HeapReAlloc
HeapAlloc
GetFileType
CreateFileW
GetCurrentDirectoryA
GetTimeZoneInformation
SetStdHandle
GetCurrentProcessId
FileTimeToSystemTime
GetVersionExA
GetFileInformationByHandle
PeekNamedPipe
DeleteFileW
GetDriveTypeW
GetFullPathNameA
GetFileAttributesW
WriteFile
GetConsoleCP
GetConsoleMode
MoveFileW
FindFirstFileExW
InterlockedDecrement
InterlockedIncrement
CreateProcessW
DuplicateHandle
FlushFileBuffers
RtlUnwind
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
DeleteFileA
SetLastError
GetCurrentThread
HeapCreate
HeapDestroy
GetTickCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
LoadLibraryW
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
HeapQueryInformation
GetProcessHeap
LCMapStringW
GetCurrentDirectoryW
SetCurrentDirectoryW
WriteConsoleW
GetFullPathNameW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
CreatePipe
RaiseException
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
CreateFileA
SetEnvironmentVariableW
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
MultiByteToWideChar
SetCurrentDirectoryA
InterlockedExchange
InterlockedCompareExchange
Sleep
GetDriveTypeA
FindFirstFileExA
ExitThread
ResumeThread
FileTimeToLocalFileTime
CreateThread
ReadFile
TlsFree
LoadLibraryA
GetSystemDirectoryA
CreateMutexA
ReleaseMutex
InitializeCriticalSection
lstrlenA

user32

MessageBoxA
EmptyClipboard
SetClipboardData
OpenClipboard
ReleaseDC
GetDC
CloseClipboard
GetClipboardData

gdi32

CreateCompatibleDC
GetObjectA
CreateDIBSection
DeleteObject
DeleteDC
SelectPalette
RealizePalette
BitBlt
CreateBitmapIndirect
SelectObject

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegEnumValueA

oleaut32

SafeArrayUnaccessData
SafeArrayRedim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData

wsock32

ioctlsocket
WSAGetLastError
gethostbyname
inet_addr
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
WSACleanup
closesocket
select
send
recv
getsockopt
__WSAFDIsSet
connect
inet_ntoa
socket
WSAStartup
listen
bind
getsockname

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 295KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8bb51e7c524602c044cab41b4b24d32c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcomp100

kernel32

user32

gdi32

advapi32

oleaut32

wsock32

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 295KB - Virtual size: 470KB

.rsrc Size: 189KB - Virtual size: 189KB

.reloc Size: 158KB - Virtual size: 158KB

.text
Size: 3.6MB - Virtual size: 3.6MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 295KB - Virtual size: 470KB

.rsrc
Size: 189KB - Virtual size: 189KB

.reloc
Size: 158KB - Virtual size: 158KB