2024-06-02_43afe9ba7937bcfd6fb527ca4179cbf0_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-02_43afe9ba7937bcfd6fb527ca4179cbf0_mafia
Size

236KB
MD5

43afe9ba7937bcfd6fb527ca4179cbf0
SHA1

9aff1498b06d72ff5017b143ebcb5a23b9b73196
SHA256

776c5159dd454f64c73e1544b176644de595ab38463e993ee332ce777cea00d2
SHA512

8e729aa1ade7900bc8e10d571fdd5adaf6a62c3db657a238d288b4413886ef8e7e4ea3801163c07621bd79df15b3c2ee3b53fdaea235b41cb042fa1cecaac3dc
SSDEEP

3072:enkmtE72opGcQWTTHON0kisXpBGCwXTCZomucag2SrfB257Ay/wx/z7LsqaGZRgk:dE54A77Nag2ofAeyc7cqP/9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-02_43afe9ba7937bcfd6fb527ca4179cbf0_mafia

Files

2024-06-02_43afe9ba7937bcfd6fb527ca4179cbf0_mafia
.exe windows:5 windows x86 arch:x86

e981436ab4cbc4ca9dd6e03fb5f3a4f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
LocalFree
GetCurrentThread
TerminateProcess
WriteConsoleW
ReadFile
WriteFile
CloseHandle
Sleep
ExitProcess
GetModuleHandleA
GetProcAddress
GetLastError
GetStdHandle
SetCurrentDirectoryA
CreateProcessA
GetCurrentProcess
LocalAlloc
CreateFileA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetProcessHeap
SetEndOfFile
SetStdHandle
LoadLibraryW
GetLocaleInfoW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
MultiByteToWideChar
GetCommandLineA
HeapSetInformation
GetCPInfo
GetModuleHandleW
HeapReAlloc
GetFileType
GetCurrentProcessId
GetTimeZoneInformation
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
GetModuleFileNameW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetEnvironmentVariableW
SetEnvironmentVariableA
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
CompareStringW
GetStringTypeW
CreateFileW

user32

MessageBoxA

advapi32

InitializeAcl
OpenThreadToken
OpenProcessToken
GetTokenInformation
LookupAccountSidA
LookupAccountNameA
IsValidSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
FreeSid
RegCloseKey
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor

ws2_32

ntohl
ntohs
htonl
htons
WSAStartup
select
send
connect
setsockopt
listen
socket
bind
getsockname
__WSAFDIsSet
recv
accept

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e981436ab4cbc4ca9dd6e03fb5f3a4f9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Sections

.text Size: 167KB - Virtual size: 167KB

.rdata Size: 37KB - Virtual size: 36KB

.data Size: 13KB - Virtual size: 26KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 167KB - Virtual size: 167KB

.rdata
Size: 37KB - Virtual size: 36KB

.data
Size: 13KB - Virtual size: 26KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 17KB - Virtual size: 16KB