2024-05-26_e2000de255005dce79b5729293fd72d0_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-26_e2000de255005dce79b5729293fd72d0_mafia
Size

3.4MB
MD5

e2000de255005dce79b5729293fd72d0
SHA1

045a6db0b17daae94ed52b0160a81e23cd94ee5c
SHA256

307e24c4a9391c94833b1c764e7ab3ab2ea4fab12eed491d59b64c4e48935298
SHA512

ff7ca9a07a4824e457622e563d725306cdb314affb050f267931564b1c06d0125629e53b1d0ec53cd6f7121534968f350157b99ed9acff97ef1591c6a807c075
SSDEEP

49152:5K8JmFCI7JwSlqnKaeEHrqnund3cLOk785ri7OsTEZMrI+DO8lJPEp7xdXU2b:5L0C4lqrHX9cLj2rsJTlEGJDPETFN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-05-26_e2000de255005dce79b5729293fd72d0_mafia

Files

2024-05-26_e2000de255005dce79b5729293fd72d0_mafia
.exe windows:5 windows x86 arch:x86

30370caaa0735398bd83c14c2a88ff2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrlenA
MultiByteToWideChar
InterlockedDecrement
LoadLibraryA
GetCurrentProcess
GetModuleHandleA
IsValidLocale
EnumSystemLocalesA
GetProcAddress
GetModuleFileNameA
Sleep
FreeLibrary
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
HeapReAlloc
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
HeapSize
GetLastError
WideCharToMultiByte
LocalFree
lstrlenW
RtlUnwind
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
RaiseException
HeapAlloc
HeapFree
ExitThread
CloseHandle
ResumeThread
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

MessageBoxA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

shell32

ShellExecuteA

ole32

CoInitialize
CoUninitialize

oleaut32

SafeArrayUnlock
SafeArrayLock
SafeArrayCreate
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
VariantCopy
VariantClear
SysAllocString
VariantInit
SetErrorInfo
VariantChangeType
GetErrorInfo
CreateErrorInfo

Sections

.text
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 349KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30370caaa0735398bd83c14c2a88ff2d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 158KB - Virtual size: 158KB

.rdata Size: 29KB - Virtual size: 28KB

.data Size: 349KB - Virtual size: 353KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 16KB - Virtual size: 16KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 158KB - Virtual size: 158KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 349KB - Virtual size: 353KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 7KB - Virtual size: 6KB