2024-05-23_b0b3323209353dfd09acb8510919754e_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-23_b0b3323209353dfd09acb8510919754e_mafia
Size

3.2MB
MD5

b0b3323209353dfd09acb8510919754e
SHA1

defb27f1527c0ba06e00bd307a985890dfcb12f2
SHA256

b9f9bd636280042f29b4064d105737eb935d8404e6d5423d4a299b1a237e1a2b
SHA512

66b3c914bf8d3e8380970ea94a58c469b2bb1fc34f9abbdccd245e003929d8367b37ba3d03acb253034c63543dc5756f40658ef5b969324c71e743af93f414e6
SSDEEP

49152:dHat7At6FVhx7rvRKnDC5xDGl0vOfh2xqsGcEs7TYTq9nnDhIRJ9ofgmfF8OuUjX:Raitg7rE0EUxq1iQVmCnU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-23_b0b3323209353dfd09acb8510919754e_mafia

Files

2024-05-23_b0b3323209353dfd09acb8510919754e_mafia
.exe windows:5 windows x86 arch:x86

4b82728bf2cd71ab449fd0eac85e0cd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\shubh\code versions\SQLyog_main_trunk_10.3 - Conman\SQLyogEnterprise\bin\release\SJA.pdb

Imports

odbc32

ord31
ord51
ord140
ord75
ord24
ord136
ord127
ord108
ord145
ord111
ord171
ord141
ord13
ord4
ord154
ord165
ord153
ord43
ord9
ord160
ord18
ord72

wsock32

htons
socket
bind
closesocket
getsockname
ntohs
WSAStartup
htonl
shutdown
connect
gethostbyname
ioctlsocket
recv
send
inet_addr
gethostbyaddr
WSAGetLastError
getservbyname
inet_ntoa
__WSAFDIsSet
setsockopt
getpeername
WSACleanup
select

wininet

HttpQueryInfoW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpSendRequestW
InternetReadFile
InternetSetOptionW
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCloseHandle
HttpOpenRequestW
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetConnectW
InternetQueryOptionW
InternetOpenW
InternetErrorDlg

shfolder

SHGetFolderPathW

shlwapi

PathFileExistsW
PathFindExtensionW

ws2_32

gethostname
getprotobyname
WSACloseEvent
WSAEnumNetworkEvents
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents

winmm

timeBeginPeriod
timeSetEvent

kernel32

GetCurrentDirectoryW
GetFullPathNameA
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetConsoleCP
HeapCreate
HeapSize
LCMapStringW
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
SetHandleCount
IsProcessorFeaturePresent
InterlockedDecrement
FlushFileBuffers
MoveFileA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
GetStdHandle
WriteConsoleW
FindFirstFileExA
GetDriveTypeA
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
IsDebuggerPresent
UnhandledExceptionFilter
GetTimeZoneInformation
HeapSetInformation
GetCommandLineA
ExitProcess
GetModuleHandleW
CreateThread
ExitThread
HeapAlloc
HeapReAlloc
HeapFree
RaiseException
EncodePointer
DecodePointer
RtlUnwind
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
GetModuleFileNameW
GetFullPathNameW
CloseHandle
WriteFile
CreateFileW
SetEndOfFile
WideCharToMultiByte
Sleep
Process32NextW
OpenProcess
TerminateProcess
Process32FirstW
CreateToolhelp32Snapshot
GetProcessId
SearchPathW
WaitForSingleObject
CreateProcessW
CreatePipe
CreateEventW
ReadFile
GetFileSize
MapViewOfFile
OpenFileMappingW
LocalFree
GetLastError
FormatMessageW
WaitForMultipleObjects
UnmapViewOfFile
CreateDirectoryW
FindClose
FindFirstFileW
lstrlenW
GetExitCodeThread
SetLastError
TerminateThread
CreateFileMappingW
GetVersion
FreeLibrary
DeleteFileW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
FindNextFileW
GetProcAddress
LoadLibraryW
SetUnhandledExceptionFilter
GetTempPathW
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
SetEnvironmentVariableW
OpenFileMappingA
OpenEventA
GetSystemDirectoryA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
FindNextFileA
FindFirstFileA
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
DeleteCriticalSection
TlsFree
GetSystemTimeAsFileTime
InitializeCriticalSection
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedIncrement
CreateEventA
ResetEvent
GetFileAttributesExA
GetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
GetVersionExA
LockFileEx
UnlockFileEx
LoadLibraryA
GetProcessHeap
DeleteFileA
CreateDirectoryA
RemoveDirectoryA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
MultiByteToWideChar
SetEvent

user32

MessageBoxW
GetDesktopWindow

advapi32

ReportEventA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegEnumValueA
RegCloseKey
GetUserNameA
ImpersonateLoggedOnUser
LogonUserA
RegisterEventSourceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

ole32

CoInitialize
CoCreateInstance
CoUninitialize

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 497KB - Virtual size: 497KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 620KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4b82728bf2cd71ab449fd0eac85e0cd2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

odbc32

wsock32

wininet

shfolder

shlwapi

ws2_32

winmm

kernel32

user32

advapi32

ole32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 497KB - Virtual size: 497KB

.data Size: 1.1MB - Virtual size: 1.1MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 620KB - Virtual size: 624KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 497KB - Virtual size: 497KB

.data
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 620KB - Virtual size: 624KB