D:\depot\_build\tc\SAPSetup\NWSapStp_09_REL\gen\dbg\java\sub\_nwsapsetup\e\01\src\OptU\ntintel\SapSmartDeleteFolder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_3dc68e05c5067ca224cb1a8cebb64e0c_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-14_3dc68e05c5067ca224cb1a8cebb64e0c_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-14_3dc68e05c5067ca224cb1a8cebb64e0c_mafia
-
Size
368KB
-
MD5
3dc68e05c5067ca224cb1a8cebb64e0c
-
SHA1
225ad849289ce1222a4a057f24dbe2b716cfe060
-
SHA256
37692b2f5416286e4972ccefae0c29c0d926076ff98508ad8ebdc3a59f1851d7
-
SHA512
82a8ba53577c8cf0280f86c49c778a8a7e1d0bc59c2272299231c56ffea6099466798e896b681e9a93ecbe9d3cae585e53aa1928181dc0cbe5052ad1de2f27a2
-
SSDEEP
6144:qhr7i0kY/c18CW2vs7NHciKicne1SCeiKoKIAy7raHadeWQllmB:qF7i0P/c1VW2vsp8iKic3TiRK+6He8OB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-14_3dc68e05c5067ca224cb1a8cebb64e0c_mafia
Files
-
2024-05-14_3dc68e05c5067ca224cb1a8cebb64e0c_mafia.exe windows:5 windows x86 arch:x86
ff8e0b244d977a4086e0973905f392eb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
Sleep
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
FindClose
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
CopyFileW
MoveFileW
CreateFileW
FindFirstFileW
FindNextFileW
WriteFile
ReadFile
SetFilePointer
CreateDirectoryW
GetDriveTypeW
GetWindowsDirectoryW
GetNativeSystemInfo
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcAddress
FormatMessageW
LocalFree
GetFileInformationByHandle
InterlockedIncrement
InterlockedDecrement
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineW
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexW
GetCurrentProcessId
GlobalMemoryStatusEx
FlushFileBuffers
DeviceIoControl
LoadLibraryW
FreeLibrary
SetErrorMode
TerminateProcess
SetCurrentDirectoryW
GetCurrentThread
VirtualQuery
ReadProcessMemory
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapSetInformation
GetStartupInfoW
GetFullPathNameW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapReAlloc
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetVersionExW
LoadLibraryA
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrlenW
WideCharToMultiByte
InitializeCriticalSection
GetLastError
advapi32
RegCloseKey
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
shell32
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ