2024-06-05_576a01c78ccb776d0dd95af26128ff86_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-06-05_576a01c78ccb776d0dd95af26128ff86_mafia
Size

230KB
MD5

576a01c78ccb776d0dd95af26128ff86
SHA1

430856c5ea00344d5c37aee4a2a2acf6ff068156
SHA256

fba880b2cf9fb52fe8d9a6ea3feb3c08e5e8d2edc0a2b195440d762b765e4d31
SHA512

47a7de3f783a66c1fdcffd1ee1a68e0f4fbcd3814a7d8edfedfe564cecbe965988aee66ade645b2c66e49b9cac10ab031875427a64d6c6da2eca9b9ded541281
SSDEEP

3072:ax0is7TrtgFP1lR+Z0vLX+wGUytAs+Eu4WollITd+qj6sP+LuCIE:ax06/Gxt/+r4WoYzP4uk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-05_576a01c78ccb776d0dd95af26128ff86_mafia

Files

2024-06-05_576a01c78ccb776d0dd95af26128ff86_mafia
.exe windows:5 windows x86 arch:x86

87ce168b2f74371a6dfe32782f3a148f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\teambuilds\TDW\TDW_V22.01.A\Sources\prd\Release\b00mprda.pdb

Imports

kernel32

HeapFree
Sleep
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetStdHandle
LeaveCriticalSection
HeapAlloc
HeapReAlloc
lstrcpyA
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
CloseHandle
_lclose
lstrlenA
lstrcatA
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetCurrentThread
GetLastError
GetCurrentThreadId
SetLastError
TlsFree
WriteConsoleW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
FlushFileBuffers

user32

EnableWindow
SetWindowPos
CheckDlgButton
EnableMenuItem
IsWindowEnabled
IsWindowVisible
SetFocus
DefWindowProcA
GetFocus
GetMenu
GetMenuState
GetSystemMenu
DeleteMenu
DrawMenuBar
PostQuitMessage
IsDlgButtonChecked
wsprintfA
GetSystemMetrics
CreateWindowExA
LoadCursorA
LoadIconA
GetSysColorBrush
RegisterClassA
UpdateWindow
MessageBeep
MessageBoxA
SendMessageA
IsWindow
SetForegroundWindow
PostMessageA
SetDlgItemTextA
GetWindowRect
GetWindowLongA
AdjustWindowRectEx
MoveWindow
ShowWindow
SetWindowTextA
GetDlgItem
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA

b00mstra

ord3
ord1

b00mkrna

InitPrint
EndPrint
EditeLigne
NewPage
PrintSetupDlg
CreateWnd_00DISP
_RegisterHelp_00HELP@12
_Help_00HELP@4
_CloseHelp_00HELP@4
GetNbLinesPerPage
_GetPCDate_00TIME@4
_GetPCTime_00TIME@4
_FormatSecond_00TIME@8
_IsUserProcessedByTDC_00PARM@0
GetKeyGreaterOrEqual
GetKeyNext
_atoi_00LONG@4
_GlobalAlloc_00MEMO@8
FormatDate_00TIME
GetHandle_00XHNG
_Alloc_00MEMO@4
Open
Close
_Free_00MEMO@4
_GlobalFree_00MEMO@4
_GetBool_00PARM@4
GetGreater
GetNext
_Lock_00MEMO@4
_Size_00MEMO@4
_Unlock_00MEMO@4
_InitGPFault@0
_UIWErreur_00ERRE@20
_GlobalUnlock_00MEMO@4
_GlobalLock_00MEMO@4
CallFileServer
DestroyWnd_00DISP
_GetInt_00PARM@4
GetPrinterNameForDisplay
CreateDialog_00JAPD
GiveHandle_00DISP
EnableClose_00DISP
TrimRight_00LONG
TrimLeft_00LONG
GetDefPrinter
_IsPrinterReady@0

b00maiwa

ReadAlarmsDictionary
GetNbAlarms
GetNbLocations
GetNbDoctors
GetNbComments
GetCountOfUsers_00USER
IsCurrentUserUserDictAccess_00USER
GetFirstUser_00USER
GetNextUser_00USER
ReadUser_00USER
GetFirstDLC
GetNextDLC
GetDLC
TubeIdToStringWithZero_11TRAN
_CodageInterne_00CDIN@16
GetAgeRanges_01AGEP
ResIntResExt_01BTRAN
CreateAndOpenDefaultDataBase
CloseAndDeleteRelationalDatabase

b00mliba

ord397
IsTestImage_00DICO
ord137
ord106
ord108
ord263
ord265
ord105
ord51
ord53
ord145
ord55
ord56
ord160
ord54
ord140
ord264
ord303
ord401

Exports

Exports

PrintDictionaries_08B
WndProcDlg_07B
WndProcG_07B

Sections

.textbss
Size: - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.TDW_SHA
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87ce168b2f74371a6dfe32782f3a148f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

b00mstra

b00mkrna

b00maiwa

b00mliba

Exports

Exports

Sections

.textbss Size: - Virtual size: 85KB

.text Size: 180KB - Virtual size: 180KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 5KB - Virtual size: 20KB

.idata Size: 7KB - Virtual size: 6KB

.TDW_SHA Size: 512B - Virtual size: 260B

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 10KB - Virtual size: 9KB

.textbss
Size: - Virtual size: 85KB

.text
Size: 180KB - Virtual size: 180KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 5KB - Virtual size: 20KB

.idata
Size: 7KB - Virtual size: 6KB

.TDW_SHA
Size: 512B - Virtual size: 260B

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 10KB - Virtual size: 9KB