2024-06-07_275ce9e1baf1c7abd57e93f58aa6a814_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_275ce9e1baf1c7abd57e93f58aa6a814_mafia
Size

1.0MB
MD5

275ce9e1baf1c7abd57e93f58aa6a814
SHA1

96d86ef53db11d3067d33637cde6655e0e1db6ec
SHA256

b78ae4ba610ae0f2eda3702bed0fbdc9175f55cc254e0e20a374752598eaaa07
SHA512

db15cf55fb37fa871ffed89c745c39380c13bae9b3ae492c5688f660dc7c0349e52248e941a58da4660254e53246b37764f257e25e161500400b714d5afa983f
SSDEEP

12288:BBtZTwBDSR39zRm6KuKCSC1XjsOPNBdkxNBOIJrc:BBtZTw4R3p4RRGJPNBdkxn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_275ce9e1baf1c7abd57e93f58aa6a814_mafia

Files

2024-06-07_275ce9e1baf1c7abd57e93f58aa6a814_mafia
.exe windows:5 windows x86 arch:x86

830cc98ab03bc685b2d7d0d5f03c8f06

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
CreateDirectoryW
WaitForSingleObject
WriteFile
SizeofResource
Beep
CreateFileW
GetTempPathW
GetLastError
LockResource
CloseHandle
FindFirstFileW
GetCurrentProcess
GetModuleHandleW
OpenProcess
GetVersionExW
GetFileAttributesW
GetModuleFileNameW
GetProcAddress
FindResourceW
RemoveDirectoryW
FindNextFileW
DeleteFileW
SetFilePointer
SystemTimeToFileTime
WideCharToMultiByte
ReadFile
MultiByteToWideChar
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetEndOfFile
CreateFileA
WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
FreeResource
FindClose
GetFileSize
GetUserDefaultLCID
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
LoadLibraryW
GetLocaleInfoW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCPInfo
ExitProcess
GetSystemTimeAsFileTime
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetProcessHeap

user32

wsprintfW
MessageBoxW
CharNextW

advapi32

RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules
EmptyWorkingSet

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winhttp

WinHttpOpenRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpGetDefaultProxyConfiguration

api-ms-win-crt-runtime-l1-1-0

terminate

setupapi

SetupDiGetDeviceInstanceIdW

lz32

LZClose
LZCopy

cmutil

SzToWz
CmStrCpyAllocA

ncrypt

BCryptDestroyHash

imagehlp

ImageNtHeader

api-ms-win-core-threadpool-l1-1-0

CreateTimerQueue
DeleteTimerQueueEx

gdi32

LPtoDP

credui

CredUICmdLinePromptForCredentialsW

mpr

WNetGetConnectionW

w32topl

ToplScheduleExportReadonly

opengl32

glIndexiv
glPixelTransferf

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

GetErrorMode

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

slc

SLGetWindowsInformationDWORD

lsasrv

LsaISetupWasRun

loadperf

UpdatePerfNameFilesA

connect

IsUniqueConnectionName

mscoree

LoadStringRCEx

wecapi

EcOpenSubscription

quartz

DllRegisterServer

iscsidsc

SetIScsiGroupPresharedKey

propsys

InitVariantFromBuffer

mf

MFCreateTranscodeTopology

nsi

NsiFreeTable

scecli

SceGenerateRollback
SceCloseProfile

sspisrv

SspiSrvClientCallback

comctl32

PropertySheetW

tapi32

lineDialA

powrprof

PowerWritePossibleValue

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

api-ms-win-crt-stdio-l1-1-0

fputs

snmpapi

SnmpSvcSetLogType

advpack

RegRestoreAll

rasman

RasPortGetBundle

pstorec

PStoreCreateInstance

authz

AuthziFreeAuditEventType
AuthzFreeHandle

httpapi

HttpRemoveUrl

gpedit

DllGetClassObject

api-ms-win-crt-math-l1-1-0

ceil

api-ms-win-service-management-l1-1-0

OpenSCManagerW

dui70

EnableAnimations

usp10

ScriptStringFree

rtutils

RouterLogDeregisterA

msdmo

MoDeleteMediaType

api-ms-win-service-winsvc-l1-1-0

ControlService

msvcr120

iswalnum

urlmon

CoInternetGetSession

msdart

MPDeleteCriticalSection

dwmapi

DwmIsCompositionEnabled

webservices

WsCreateWriter

api-ms-win-service-management-l2-1-0

NotifyServiceStatusChangeW

resutils

ResUtilGetSzValue

bcrypt

BCryptImportKey

dciman32

DCIDestroy

oledlg

OleUIChangeSourceA

wmsgapi

WmsgSendMessage

uxtheme

GetThemeTextExtent

unattend

UnattendCtxCleanup

api-ms-win-core-misc-l1-1-0

lstrlenW

rpcrt4

RpcAsyncCompleteCall
MesHandleFree

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 328KB - Virtual size: 327KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.l1
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

830cc98ab03bc685b2d7d0d5f03c8f06

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

psapi

version

winhttp

api-ms-win-crt-runtime-l1-1-0

setupapi

lz32

cmutil

ncrypt

imagehlp

api-ms-win-core-threadpool-l1-1-0

gdi32

credui

mpr

w32topl

opengl32

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-debug-l1-1-0

slc

lsasrv

loadperf

connect

mscoree

wecapi

quartz

iscsidsc

propsys

mf

nsi

scecli

sspisrv

comctl32

tapi32

powrprof

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-crt-stdio-l1-1-0

snmpapi

advpack

rasman

pstorec

authz

httpapi

gpedit

api-ms-win-crt-math-l1-1-0

api-ms-win-service-management-l1-1-0

dui70

usp10

rtutils

msdmo

api-ms-win-service-winsvc-l1-1-0

msvcr120

urlmon

msdart

dwmapi

webservices

api-ms-win-service-management-l2-1-0

resutils

bcrypt

dciman32

oledlg

wmsgapi

uxtheme

unattend

api-ms-win-core-misc-l1-1-0

rpcrt4

Sections

.text
Size: 116KB - Virtual size: 115KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 11KB - Virtual size: 18KB

.rsrc
Size: 328KB - Virtual size: 327KB

.reloc
Size: 9KB - Virtual size: 9KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 4KB - Virtual size: 4KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 5KB - Virtual size: 5KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 6KB - Virtual size: 6KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 7KB - Virtual size: 7KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB

.l1
Size: 8KB - Virtual size: 8KB