2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia
Size 784KB
Sample240603-lpwydabf74
SHA256 85b754bc848ccfbc8577928580a0e67c68112b2a80e6a6af0173883985d23a53
MD5 53d100c45eb726f3f471ead02ccb7407
SHA1 5d779551271b9ead192afd5c6305dc768a60b013
SHA512 13d9b118c06cba5219d381796a6adfccfc6da1a2f3d7a094865ef7eca9d8681ef55634b0d4ad459340bec7044f16572abdc0ba930857f154cba1715870ed39a5
SSDEEP 24576:zvKiH/ugOwnUFbG3g1GxSdxva8k87hV33kec:zyiH/qsUo3g4xSzva8k8tVHo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia

File Explorer

2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia

.exe 784KB

2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia

IMPHASH 7250af2dab9452395073aed06846fb6c
SHA256 85b754bc848ccfbc8577928580a0e67c68112b2a80e6a6af0173883985d23a53
MD5 53d100c45eb726f3f471ead02ccb7407
SHA1 5d779551271b9ead192afd5c6305dc768a60b013
SHA512 13d9b118c06cba5219d381796a6adfccfc6da1a2f3d7a094865ef7eca9d8681ef55634b0d4ad459340bec7044f16572abdc0ba930857f154cba1715870ed39a5
SSDEEP 24576:zvKiH/ugOwnUFbG3g1GxSdxva8k87hV33kec:zyiH/qsUo3g4xSzva8k8tVHo
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\amigo_28\src\build\Release\amigo.exe.pdb

shlwapi

PathRemoveFileSpecW PathFileExistsW

kernel32

SetCurrentDirectoryW LoadLibraryExW GetModuleFileNameW GetTempPathW GetEnvironmentVariableW CreateProcessW CloseHandle GetLastError GetModuleHandleW VirtualProtect DuplicateHandle GetExitCodeProcess WaitForSingleObject SizeofResource LockResource LoadResource FindResourceW VirtualFree SetFilePointer ReadFile GetSystemInfo FreeLibrary VirtualAlloc CreateFileW lstrlenW IsDebuggerPresent CreateEventW ExpandEnvironmentStringsW GetCurrentProcessId GetTickCount ReleaseMutex SetLastError CreateMutexW WriteFile OutputDebugStringA SetEnvironmentVariableW GetUserDefaultLangID InterlockedExchange QueryPerformanceCounter GetSystemTimeAsFileTime QueryPerformanceFrequency GetNativeSystemInfo GetVersionExW OpenProcess GetProcessId SetInformationJobObject VirtualQueryEx HeapSetInformation GetStdHandle SetHandleInformation ResumeThread AssignProcessToJobObject LocalAlloc GetFileAttributesW VirtualAllocEx GetLongPathNameW GetCurrentDirectoryW MapViewOfFile CreateFileMappingW QueryDosDeviceW GetLocaleInfoW GetUserDefaultUILanguage InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RaiseException CreateThread GetCurrentThreadId RtlCaptureStackBackTrace InterlockedExchangeAdd TlsAlloc TlsGetValue TlsFree TlsSetValue ResetEvent SetEvent WaitForMultipleObjects LoadLibraryA GetWindowsDirectoryW SetEndOfFile FlushFileBuffers UnregisterWaitEx RegisterWaitForSingleObject GetModuleHandleExW GetQueuedCompletionStatus CreateIoCompletionPort PostQueuedCompletionStatus InterlockedIncrement ReleaseSemaphore InterlockedDecrement RtlCaptureContext CreateSemaphoreW InitializeCriticalSection GetThreadContext SuspendThread WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState WriteProcessMemory VirtualProtectEx TerminateJobObject SignalObjectAndWait GetProcessHandleCount GetFileType CreateJobObjectW CreateNamedPipeW OpenEventW SearchPathW DebugBreak ReadProcessMemory WideCharToMultiByte GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer UnhandledExceptionFilter HeapFree ExitProcess GetStartupInfoW GetConsoleCP GetConsoleMode HeapReAlloc GetFullPathNameW HeapAlloc GetProcessHeap SetStdHandle LCMapStringW GetCPInfo RtlUnwind IsProcessorFeaturePresent HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapSize GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation WriteConsoleW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetDriveTypeW CompareStringW VirtualFreeEx SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep CreateRemoteThread GetModuleHandleA FormatMessageW LocalFree GetEnvironmentVariableA GetCommandLineW SetEnvironmentVariableA LoadLibraryW GetProcAddress GetSystemDirectoryW

user32

GetUserObjectInformationW GetThreadDesktop SetProcessWindowStation CreateDesktopW GetProcessWindowStation CreateWindowStationW CloseDesktop wsprintfW MessageBoxW CloseWindowStation CharUpperW

userenv

GetProfileType

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeGetTime

advapi32

GetTraceEnableLevel SetEntriesInAclW OpenProcessToken GetTokenInformation ConvertSidToStringSidW RegCreateKeyExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey CreateProcessAsUserW GetTraceEnableFlags GetTraceLoggerHandle UnregisterTraceGuids TraceEvent RegisterTraceGuidsW RegDisablePredefinedCache RevertToSelf SetTokenInformation GetLengthSid ConvertStringSidToSidW GetSecurityInfo CreateWellKnownSid CopySid LookupPrivilegeValueW EqualSid DuplicateToken DuplicateTokenEx CreateRestrictedToken SetThreadToken

Name

.text

Size

405KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia

shlwapi

kernel32

user32

userenv

version

winmm

advapi32

generic