2024-05-24_f71091bb069bab076507b19d3dde7c32_mafia_qakbot | Triage

Sharing

General

Target

2024-05-24_f71091bb069bab076507b19d3dde7c32_mafia_qakbot
Size

979KB
MD5

f71091bb069bab076507b19d3dde7c32
SHA1

a8f37c3e6f57464017ec7f9d9ca9df9469c3f848
SHA256

c57af9a2450020629fa059debda6094c3573f25a94b784c3aa4431626d95c958
SHA512

bc8ea7865443146886f0ef47330d4ce4bc1d12680095637e49373f6cb784bb9860521bb4e699f0076959cac396be4eb50d969f6618eb49ceeab24800f66569d4
SSDEEP

24576:wYsdpnTQNT1h7NWrgovNg+S4lCkKOS2TvOf:rsdesv+F4lglf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-24_f71091bb069bab076507b19d3dde7c32_mafia_qakbot

Files

2024-05-24_f71091bb069bab076507b19d3dde7c32_mafia_qakbot
.exe windows:5 windows x86 arch:x86

06fa29813db6c1f98441703604fe5cf8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetModuleHandleA
VirtualProtect
ExitProcess

Sections

.text
Size: 588KB - Virtual size: 588KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ