E:\pre_i18_per_to_202007_061\Build\Release\WPSOffice\wtoolex\updateself.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_3e45356197db7a5fb190b00a5b8dec56_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-31_3e45356197db7a5fb190b00a5b8dec56_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-31_3e45356197db7a5fb190b00a5b8dec56_mafia
-
Size
1.3MB
-
MD5
3e45356197db7a5fb190b00a5b8dec56
-
SHA1
db04f5e54a608f13c34ff0c5b69172f333b3415b
-
SHA256
f487fe9a08ccc167b98032f445f2f580dcfbd023fb8cc5b34d2ff27fff887252
-
SHA512
cad36e1a0e20a5720512ed6c8cf568286976e2faa709bf39d4ea4abb52837121659373507a822dd8eb7f707dc0c28af7764ee02bccf10530f84b95c6f199060e
-
SSDEEP
24576:Q6cDtdda81uqgma9kf2M9jRFEM4XlhafCLTMt2rR8FfBhRJUEbDk1ulU6:QTtTa81ugMMulFnMt2r4PRSEk1ul
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-31_3e45356197db7a5fb190b00a5b8dec56_mafia
Files
-
2024-05-31_3e45356197db7a5fb190b00a5b8dec56_mafia.exe windows:5 windows x86 arch:x86
5df414f973933ae88231b7b412f6e16d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
GetCurrentThread
CloseHandle
GetLastError
GetVersionExW
SetLastError
InterlockedDecrement
LocalFree
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetProcAddress
LoadLibraryW
GetDateFormatW
GetTimeFormatW
GetVersion
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrlenW
OpenProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetFileAttributesW
GetUserDefaultLCID
IsWow64Process
GetCommandLineW
lstrlenA
Sleep
ExpandEnvironmentStringsW
DeleteFileW
FindClose
GetModuleHandleW
GetModuleFileNameW
RemoveDirectoryW
FindNextFileW
MoveFileExW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GlobalFree
WaitForSingleObject
WriteFile
CreateFileW
GetModuleHandleA
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
GetExitCodeProcess
CopyFileW
CreateEventW
ResetEvent
SetEvent
ResumeThread
InterlockedExchange
SetFilePointer
GetTickCount
ReadFile
MoveFileW
GetExitCodeThread
CreateThread
GetFileAttributesExW
ReleaseMutex
OutputDebugStringW
GetCurrentThreadId
GetFileSize
CreateMutexW
SetFileAttributesW
GetPrivateProfileSectionW
LocalAlloc
RaiseException
GetUserDefaultUILanguage
DeviceIoControl
CreateFileA
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
SleepEx
QueryPerformanceCounter
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FormatMessageA
GetSystemTime
InterlockedIncrement
GetStringTypeW
InterlockedCompareExchange
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindFirstFileExW
GetDriveTypeA
ExitThread
GetFileInformationByHandle
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetDriveTypeW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
Sections
.text Size: 538KB - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 604KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE