2024-06-01_829d7998f378afe1193b30f0ed364e0b_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-01_829d7998f378afe1193b30f0ed364e0b_mafia
Size

2.3MB
MD5

829d7998f378afe1193b30f0ed364e0b
SHA1

ff767776525060b8e6b3f7cc1d29daac44308cd9
SHA256

46b5441aa5ac4b1b8f20d9d8eda9567b185f9d982408eaeb93adf8b2dc73f76c
SHA512

fc049c3629273ab661db4c1ae5d959aeb1b18d252beb0363dbe0aef042f664f1d49eacec4a13d9725a50dc5d8b71f8e98037774f262a40c2d337ce78c83eea44
SSDEEP

49152:OTrgaJwX/7m5YSE4dI0bocSGBIJsv6tWKFdu9CNPAZO7H9ry0mRYPUFwR0FqWvbk:OTQX/7m5YSE4dI2oc/BIJsv6tWKFdu9k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-01_829d7998f378afe1193b30f0ed364e0b_mafia

Files

2024-06-01_829d7998f378afe1193b30f0ed364e0b_mafia
.exe windows:5 windows x86 arch:x86

c255cac0f52940118c3a92107b95874b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileInformationByHandle
SetErrorMode
FindClose
FindFirstFileW
CloseHandle
CreateFileW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesW
CopyFileW
MoveFileW
DeleteFileW
GetFullPathNameW
GetCurrentDirectoryW
LoadLibraryW
GetCurrentProcess
DeviceIoControl
GetLogicalDrives
GetFileAttributesExW
WaitForSingleObject
SetEvent
CreateEventW
GetCurrentThreadId
TlsFree
TlsSetValue
GetSystemInfo
Sleep
SetThreadPriority
GetCurrentThread
TlsAlloc
TerminateThread
ResumeThread
GetThreadPriority
TlsGetValue
WaitForMultipleObjects
CreateThread
DuplicateHandle
QueryPerformanceFrequency
GetModuleHandleW
GetTickCount
QueryPerformanceCounter
GetModuleFileNameW
GetLocaleInfoW
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultUILanguage
CreateMutexW
ReleaseMutex
VirtualFree
MultiByteToWideChar
WideCharToMultiByte
FlushFileBuffers
GetFileType
SetFilePointerEx
ReadFile
WriteFile
MoveFileExW
SetEndOfFile
GetProcAddress
CreateFileMappingW
UnmapViewOfFile
GetSystemDirectoryW
GetGeoInfoW
GetUserGeoID
GetTimeZoneInformation
ResetEvent
FindNextFileW
FindFirstFileExW
FreeLibrary
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetCommandLineA
HeapSetInformation
HeapFree
HeapAlloc
HeapReAlloc
SetFilePointer
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
InitializeCriticalSectionAndSpinCount
SetFileAttributesW
ExitThread
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetLastError
IsProcessorFeaturePresent
HeapSize
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA
WriteConsoleW
GetDriveTypeW
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
OutputDebugStringW
OutputDebugStringA
GetConsoleWindow
GetStartupInfoW
GetLastError
FormatMessageW
LocalFree
GetVersionExW
VerSetConditionMask
VerifyVersionInfoW
GetCurrentProcessId
GetSystemTime
GetLocalTime
GetUserDefaultLCID
MapViewOfFile
CompareStringW

user32

MsgWaitForMultipleObjectsEx
CharNextExA
SetTimer
KillTimer
PeekMessageW
DefWindowProcW
GetWindowLongW
TranslateMessage
DispatchMessageW
SetWindowsHookExW
UnhookWindowsHookEx
RegisterClassW
CreateWindowExW
SetWindowLongW
DestroyWindow
UnregisterClassW
GetQueueStatus
PostMessageW
CallNextHookEx

ole32

CoUninitialize
CoInitialize
CoCreateInstance

advapi32

FreeSid
GetLengthSid
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
CopySid

ws2_32

WSAAsyncSelect

Exports

Exports

z_adler32
z_adler32_combine
z_adler32_combine64
z_compress
z_compress2
z_compressBound
z_crc32
z_crc32_combine
z_crc32_combine64
z_deflate
z_deflateBound
z_deflateCopy
z_deflateEnd
z_deflateInit2_
z_deflateInit_
z_deflateParams
z_deflatePrime
z_deflateReset
z_deflateSetDictionary
z_deflateSetHeader
z_deflateTune
z_get_crc_table
z_inflate
z_inflateCopy
z_inflateEnd
z_inflateGetHeader
z_inflateInit2_
z_inflateInit_
z_inflateMark
z_inflatePrime
z_inflateReset
z_inflateReset2
z_inflateSetDictionary
z_inflateSync
z_inflateSyncPoint
z_inflateUndermine
z_uncompress
z_zError
z_zlibCompileFlags
z_zlibVersion

Sections

.text
Size: 934KB - Virtual size: 934KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c255cac0f52940118c3a92107b95874b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 934KB - Virtual size: 934KB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 20KB - Virtual size: 30KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 79KB - Virtual size: 78KB

.text
Size: 934KB - Virtual size: 934KB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 20KB - Virtual size: 30KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 79KB - Virtual size: 78KB