2024-05-12_c3ab8f72fd4bc2f953c0fdd2656646f4_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-12_c3ab8f72fd4bc2f953c0fdd2656646f4_mafia
Size

1.2MB
MD5

c3ab8f72fd4bc2f953c0fdd2656646f4
SHA1

8e3e8604ab3cfcae5d0168ddac87df45b6b3ee57
SHA256

52ce76188c4777d587a3861aa248163cae36f5ccd2332c1a6de9b1ff6af08721
SHA512

6c1d87c9e3d6010e8c25551989597b5dfdf21ef24e5ea54046187fae576e5ae823fd744ed87f154682183547e8a118654ddc7945f2759358b0daf26774283020
SSDEEP

24576:MdNY5gS6YxtbUqlK4DDkCy63FopJHNU0hUhxOJ/MVW0QchM:CagSTxtAqK6YCDFopZJ/MVW0BhM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-12_c3ab8f72fd4bc2f953c0fdd2656646f4_mafia

Files

2024-05-12_c3ab8f72fd4bc2f953c0fdd2656646f4_mafia
.exe windows:5 windows x86 arch:x86

8c3dc05b99d9e80a57c5bdf66d13b394

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Windows\Documents\TS\TS\build\bin\GameServer.pdb

Imports

kernel32

WaitForMultipleObjectsEx
WaitForSingleObject
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
FormatMessageA
GetProcessHeap
SetEndOfFile
CreateFileA
WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetFilePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetLastError
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetTickCount
FreeLibrary
CloseHandle
SetLastError
GetCurrentDirectoryA
GetModuleFileNameA
GetEnvironmentVariableA
SuspendThread
GetThreadContext
ResumeThread
ReadProcessMemory
GetVersionExA
OutputDebugStringA
SetUnhandledExceptionFilter
lstrlenA
VirtualQuery
GetLocalTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualFree
GetSystemTimeAsFileTime
VirtualAlloc
GetSystemInfo
SetEvent
ResetEvent
WaitForMultipleObjects
ReleaseMutex
GetACP
GetLocaleInfoA
GetThreadLocale
WriteFile
QueryPerformanceFrequency
InterlockedCompareExchange
InterlockedExchange
EncodePointer
DecodePointer
LoadLibraryA
GetModuleHandleA
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
HeapFree
GetCommandLineA
HeapSetInformation
ExitProcess
HeapAlloc
RtlUnwind
RaiseException
ExitThread
CreateThread
GetCPInfo
LCMapStringW
IsProcessorFeaturePresent
HeapCreate
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
HeapSize
GetLocaleInfoW
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
CreateEventW

ws2_32

htons
WSACleanup
WSAEnumNetworkEvents
WSAStringToAddressW
ntohs
gethostbyaddr
inet_ntoa
htonl
inet_addr
WSACreateEvent
send
setsockopt
closesocket
gethostname
WSAGetLastError
bind
WSAIoctl
WSASocketW
listen
shutdown
ioctlsocket
WSARecv
WSASend
WSARecvFrom
WSASendTo
getsockname
recv
getsockopt
gethostbyname
__WSAFDIsSet
socket
select
connect
WSAStartup
WSACloseEvent
WSAEventSelect

ole32

CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CLSIDFromProgID
CoInitialize
CoUninitialize
CoInitializeEx
CoGetMalloc

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime
timeEndPeriod

version

GetFileVersionInfoA
GetFileVersionInfoSizeA

advapi32

RegCloseKey
GetUserNameA

oleaut32

VariantClear
SafeArrayDestroy
SysAllocString
SysFreeString

Sections

.text
Size: 965KB - Virtual size: 964KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 529B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c3dc05b99d9e80a57c5bdf66d13b394

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ws2_32

ole32

winmm

version

advapi32

oleaut32

Sections

.text Size: 965KB - Virtual size: 964KB

.rdata Size: 203KB - Virtual size: 203KB

.data Size: 26KB - Virtual size: 48KB

.tls Size: 1024B - Virtual size: 529B

.reloc Size: 83KB - Virtual size: 82KB

.text
Size: 965KB - Virtual size: 964KB

.rdata
Size: 203KB - Virtual size: 203KB

.data
Size: 26KB - Virtual size: 48KB

.tls
Size: 1024B - Virtual size: 529B

.reloc
Size: 83KB - Virtual size: 82KB