2024-05-27_47ddfd6cd4c42e12ffaf3268cd6fc7c3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-27_47ddfd6cd4c42e12ffaf3268cd6fc7c3_mafia
Size

345KB
MD5

47ddfd6cd4c42e12ffaf3268cd6fc7c3
SHA1

004509b63073f848851ea9d229ff0dd596be84e0
SHA256

34bc87ff646de569eb86c44afd516605f1c294ff4e4ac504c940a990ba82de42
SHA512

f96b459695e960926b50dff69b19b10a8814f7496da74adc891fccf76b7ebb11ae29f495fbd52a2c9ce65d96f02ee19aa5ddea42a7c805d4a8db1bb72ab3b516
SSDEEP

6144:T1aI/2UtCKpBJs6cpidfUK1DU54Tsj1mclW/zpBeajEd2y:T1aI/gKpbs6cp2UoDU5fj8clW/FBtBy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-27_47ddfd6cd4c42e12ffaf3268cd6fc7c3_mafia

Files

2024-05-27_47ddfd6cd4c42e12ffaf3268cd6fc7c3_mafia
.exe windows:5 windows x86 arch:x86

9c87bd7d8a771a7147c16dd62e25ab57

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Program Files (x86)\IVMS Server\bin\IVMSDevDaily.pdb

Imports

user32

wsprintfW

advapi32

DeleteService
ControlService
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
QueryServiceStatus
ChangeServiceConfig2W
CreateServiceW
RegisterEventSourceW
CloseServiceHandle
OpenSCManagerW
StartServiceCtrlDispatcherW
OpenServiceW
DeregisterEventSource

libmysql

mysql_list_dbs
mysql_store_result
mysql_list_tables
mysql_real_connect
mysql_query
mysql_options
mysql_error
mysql_insert_id
mysql_close
mysql_num_rows
mysql_fetch_lengths
mysql_free_result
mysql_num_fields
mysql_fetch_field
mysql_fetch_row
mysql_select_db
mysql_errno
mysql_init

kernel32

IsValidLocale
HeapReAlloc
SetStdHandle
WriteConsoleW
SetEndOfFile
GetProcessHeap
SetEnvironmentVariableA
LeaveCriticalSection
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
ReadFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
WriteFile
ExitProcess
HeapSize
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
LoadLibraryW
GetProcAddress
CreateMutexW
GetLastError
CloseHandle
Sleep
FindFirstFileW
CreateDirectoryW
FileTimeToSystemTime
CreateFileW
FindClose
FindNextFileW
GetFileTime
DeleteFileW
WideCharToMultiByte
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
EnterCriticalSection
GetCurrentThreadId
WaitForSingleObject
SetEvent
SetThreadPriority
ResetEvent
CreateEventW
CreateThread
GetTickCount64
SystemTimeToFileTime
GetLocalTime
GetTimeZoneInformation
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
TerminateProcess
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
GetLocaleInfoW
GetCommandLineW
HeapSetInformation
HeapFree
HeapAlloc
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent

Sections

.text
Size: 273KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c87bd7d8a771a7147c16dd62e25ab57

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

advapi32

libmysql

kernel32

Sections

.text Size: 273KB - Virtual size: 272KB

.rdata Size: 41KB - Virtual size: 41KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 1024B - Virtual size: 696B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 273KB - Virtual size: 272KB

.rdata
Size: 41KB - Virtual size: 41KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 1024B - Virtual size: 696B

.reloc
Size: 20KB - Virtual size: 19KB