2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia
Size 253KB
Sample240602-2ctv9aad36
SHA256 bbb397ca9188b92747355ae0465f0290a189c32d457708084575df95b3e52f2a
MD5 a4d9939515e163cdca4f13d86baff872
SHA1 5acfd45e159e6963e7a0f818ab53be41ee278e69
SHA512 bc53279a30be393282a44d7ea3302ea0b59b8b44d2f578a39cc65c9d41f9fa6d1463ac30a091cfd983d4ebe0e372199954035461926f920988fa016e07990679
SSDEEP 3072:R12DOa5l/LMb/jbI+k619eel+rxynat4T3ArRAniuwxmtN519vl+nzSmy:dGykeUaat63ArXFo57NsSm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia

File Explorer

2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia

.exe 253KB

2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia

IMPHASH f97e67ca69f848759d0c4007af455722
SHA256 bbb397ca9188b92747355ae0465f0290a189c32d457708084575df95b3e52f2a
MD5 a4d9939515e163cdca4f13d86baff872
SHA1 5acfd45e159e6963e7a0f818ab53be41ee278e69
SHA512 bc53279a30be393282a44d7ea3302ea0b59b8b44d2f578a39cc65c9d41f9fa6d1463ac30a091cfd983d4ebe0e372199954035461926f920988fa016e07990679
SSDEEP 3072:R12DOa5l/LMb/jbI+k619eel+rxynat4T3ArRAniuwxmtN519vl+nzSmy:dGykeUaat63ArXFo57NsSm
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105023

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetGetConnectionA

kernel32

ReadFile TerminateProcess DeleteFileA WriteFile GetCurrentThread LocalAlloc WriteConsoleW IsValidLocale CloseHandle Sleep ExitProcess GetModuleHandleA GetProcAddress GetLastError GetStdHandle SetCurrentDirectoryA CreateProcessA GetDriveTypeA GetCurrentProcess CreateFileA LocalFree HeapFree EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize GetProcessHeap SetEndOfFile SetStdHandle LoadLibraryW GetLocaleInfoW GetStringTypeW CompareStringW GetTickCount InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateFileW HeapAlloc MultiByteToWideChar GetCommandLineA HeapSetInformation GetCPInfo GetModuleHandleW HeapReAlloc GetFileType GetCurrentProcessId GetTimeZoneInformation GetSystemTimeAsFileTime RaiseException RtlUnwind WideCharToMultiByte LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent SetHandleCount InitializeCriticalSectionAndSpinCount GetStartupInfoW IsProcessorFeaturePresent HeapCreate GetModuleFileNameW SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId SetEnvironmentVariableW SetEnvironmentVariableA GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter

user32

MessageBoxA

advapi32

InitializeAcl OpenThreadToken OpenProcessToken GetTokenInformation LookupAccountSidA LookupAccountNameA IsValidSid AddAccessAllowedAce SetSecurityDescriptorDacl SetFileSecurityA FreeSid RegCloseKey GetUserNameA RegOpenKeyExA RegQueryValueExA InitializeSecurityDescriptor

shell32

SHGetFolderPathA

ws2_32

htons WSAStartup select accept connect htonl listen socket bind getsockname __WSAFDIsSet ntohs ntohl recv send setsockopt

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-02_a4d9939515e163cdca4f13d86baff872_mafia

mpr

kernel32

user32

advapi32

shell32

ws2_32

generic