2024-06-05_ee5ed91a3217740a8e131cefc328e8c1_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-05_ee5ed91a3217740a8e131cefc328e8c1_mafia
Size

275KB
MD5

ee5ed91a3217740a8e131cefc328e8c1
SHA1

997e242b9e5b78caab45a4df6cca7f16ea819649
SHA256

d6301721bf67e83b873175456ad65170b34b8f3d0637b1011d770a2e5c9dec8f
SHA512

2de1f82d485f4e55613fcc48164b7efeb8aff7e015fa2666f89e7317c81dde6aac23633e3cdc217b2e167ff9b86e9e424d7cc579b51ab24b84ef1decb22a0f07
SSDEEP

3072:YPTXvtFceA2GzmuF2n0uq44oSS8FyIWc9+6JiB9u5mIyJDFm5uvnOsm:mTfs2cT4n27+MiB9IkFm5Im

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-05_ee5ed91a3217740a8e131cefc328e8c1_mafia

Files

2024-06-05_ee5ed91a3217740a8e131cefc328e8c1_mafia
.exe windows:5 windows x86 arch:x86

765a9b2919e99980d814fb1a9cd4a0ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\teambuilds\TDW\TDW_V22.01.A\Sources\sysm\Release\b04ssysm.pdb

Imports

kernel32

GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetLastError
GetCurrentThread
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
CloseHandle
EnterCriticalSection
EncodePointer
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
Sleep
LCMapStringW
MultiByteToWideChar
GetStringTypeW
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
SetStdHandle
FlushFileBuffers
CreateFileA
WriteConsoleW
HeapAlloc
HeapReAlloc
HeapSize
ReadFile
SetEndOfFile
GetProcessHeap
CreateFileW
GetCurrentProcess
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineA
OutputDebugStringA
lstrcmpA
lstrlenA
DecodePointer
IsDebuggerPresent
LeaveCriticalSection
SetUnhandledExceptionFilter
ExitProcess
GlobalUnlock

user32

CreateWindowExA
LoadCursorA
RegisterClassA
SetWindowTextA
PostMessageA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
GetSystemMenu
ChangeMenuA
DrawMenuBar
DestroyWindow
DefWindowProcA
MessageBeep
PostQuitMessage
BeginPaint
IsIconic
LoadIconA
DrawIcon
EndPaint
wsprintfA

b00mstra

ord1

b00mkrna

SetInstDisConnectedForTSE
SharedLock_00SHAR
_Alloc_00MEMO@4
_Lock_00MEMO@4
SharedUnlock_00SHAR
_itoa_00LONG@12
_atoi_00LONG@4
CallFS
_UIWErreur_00ERRE@20
Request
_GlobalFree_00MEMO@4
_GlobalAlloc_00MEMO@8
_GlobalLock_00MEMO@4
FindData_00DISP
FindNext
_GlobalUnlock_00MEMO@4
ReleaseData_00DISP
DeleteData_00DISP
IsMultiWSTServer_00PARM
DestroyWnd_00DISP
FlushComm_00USEI
SetCommState_00USEI
GetCommState_00USEI
OpenComm_00USEI
CloseComm_00USEI
EscapeCommFunction_00USEI
WriteComm_00USEI
DestroyIOThread
_GetBool_00PARM@4
_Unlock_00MEMO@4
_InitGPFault@0
GetHandle_00XHNG
InsertWnd_00DISP
SetHandle_00XHNG
SetCommEventMask_00USEI

b00maiwa

TubeIdToString_11TRAN
StringToTubePos_11TRAN
StringToTubeId_11TRAN
TranscodageInstHost_01RESU

b00mliba

ord338
TraceSpyCom_00SPYV
ord373
_RemplissageChamp_00BCADR@20
IsDemoKey_01ERRE
ord347

b00mcnxa

ord161
ord163
ord162
ord164
ord165
ord119
_TreatPatId_00TKEY@36
ord120
ord123
ord147
ord124
ord122
ord121
ord160
ord130
ord131
ord126
ord127
ord128
ord132
ord133
ord134
ord125
ord140
ord141
ord142
ord143
ord175
ord159
ord129
ord139
ord144
ord145
ord146
ord157
ord158
ord112
ord105
ord106
ord104
ord137
ord138
ord101
ord103
ord118
ord150
ord168
ord116
ord148
ord167
ord166
ord152
ord151
ord155
ord156

gdi32

CreateSolidBrush

Sections

.textbss
Size: - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

765a9b2919e99980d814fb1a9cd4a0ec

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

b00mstra

b00mkrna

b00maiwa

b00mliba

b00mcnxa

gdi32

Sections

.textbss Size: - Virtual size: 106KB

.text Size: 223KB - Virtual size: 222KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 11KB - Virtual size: 186KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 13KB - Virtual size: 13KB

.textbss
Size: - Virtual size: 106KB

.text
Size: 223KB - Virtual size: 222KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 11KB - Virtual size: 186KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 13KB - Virtual size: 13KB