D:\depot\_build\tc\SAPSetup\NWSapStp_09_REL\gen\dbg\java\sub\_nwsapsetup\e\01\src\OptU\ntintel\SapSmartDeleteFolder.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-05_b54b22fc3bbefaa3c26c26912a318156_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-05_b54b22fc3bbefaa3c26c26912a318156_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-05_b54b22fc3bbefaa3c26c26912a318156_mafia
-
Size
368KB
-
MD5
b54b22fc3bbefaa3c26c26912a318156
-
SHA1
9320c3cd69152a82481911853e7c05df8fc7889e
-
SHA256
033da2f25a0a1e97b227dcd1492715f77b8728f418c2f22803bc3aea4d2986b5
-
SHA512
bf0312567f8b581c47333c68791c952426e806e25c8a151cc9e063264cac6656310cf9b59b0f96fd04ff323fc891cbc08b63d75f86d945f29fa76ed7efdaf9aa
-
SSDEEP
6144:zexNiG1Oqsxfu0GcAaSF0KYZUQSj+kZ7KN9Lni7uke2pY:ziNiGMqsxm0GcAdF0KYZDS3Z789Lni7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-05_b54b22fc3bbefaa3c26c26912a318156_mafia
Files
-
2024-06-05_b54b22fc3bbefaa3c26c26912a318156_mafia.exe windows:5 windows x86 arch:x86
d7e3a3a5e8dcd8187c74643326769925
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CloseHandle
Sleep
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
FindClose
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
RemoveDirectoryW
CopyFileW
MoveFileW
CreateFileW
FindFirstFileW
FindNextFileW
WriteFile
ReadFile
SetFilePointer
CreateDirectoryW
GetDriveTypeW
GetWindowsDirectoryW
GetNativeSystemInfo
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcAddress
FormatMessageW
LocalFree
GetFileInformationByHandle
InterlockedIncrement
InterlockedDecrement
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexW
GetCurrentProcessId
GlobalMemoryStatusEx
FlushFileBuffers
DeviceIoControl
LoadLibraryW
FreeLibrary
SetErrorMode
TerminateProcess
SetCurrentDirectoryW
GetCurrentThread
VirtualQuery
ReadProcessMemory
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapSetInformation
GetStartupInfoW
GetFullPathNameW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapReAlloc
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringW
GetPrivateProfileIntW
GetVersionExW
LoadLibraryA
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
CreateMutexW
lstrlenW
WideCharToMultiByte
DeleteCriticalSection
GetLastError
advapi32
RegCloseKey
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
GetUserNameW
RegOpenKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
shell32
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
Sections
.text Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ