2024-06-07_3870cf2630243e52ba442e926e7f3b59_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-07_3870cf2630243e52ba442e926e7f3b59_mafia
Size

498KB
MD5

3870cf2630243e52ba442e926e7f3b59
SHA1

1a1fa91ca81c8c566196877a459485326fb15c5a
SHA256

66ea304f5580f9d08b595b9cf0de120143441ae2eb512e8700015853fed8c56c
SHA512

fa29cc9bea011f64f68094a06be46e146fb99477348d0f9e42ac75e98273b62de0af3504af9db6dc3dd0486fe9d7d3025f306119ef04dc795a9678997939dea9
SSDEEP

12288:f1icfX1jszWBDODVsuAAGhlrelpWfmCeGxPa0LO:f1icfX1jszWBDyVshAGCW6GVa0L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-07_3870cf2630243e52ba442e926e7f3b59_mafia

Files

2024-06-07_3870cf2630243e52ba442e926e7f3b59_mafia
.exe windows:5 windows x86 arch:x86

116dc207caa218f2740c520ecf7dfb2d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\bld_area\SEP_12.1\Output\Install\Bin.iru\SylinkDrop.pdb

Imports

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetLastError
lstrlenA
CloseHandle
CreateFileW
ReadFile
InterlockedDecrement
LoadLibraryW
FreeLibrary
DeleteFileW
MoveFileW
WaitForSingleObject
GetModuleFileNameW
GetFileSize
WriteFile
CreateProcessW
GetExitCodeProcess
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
GetEnvironmentVariableW
SetFilePointer
CopyFileW
GetVersionExW
HeapFree
GetProcessHeap
VirtualFree
HeapSize
HeapAlloc
VirtualAlloc
GetSystemInfo
HeapReAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
TlsSetValue
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DeleteCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OutputDebugStringW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentThread
LoadLibraryExW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetLongPathNameW
GetCurrentProcessId
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreW
OpenSemaphoreW
SetEvent
PulseEvent
ResetEvent
CreateEventW
OpenEventW
WaitForMultipleObjects
GetTickCount
WaitForMultipleObjectsEx
FormatMessageA
GetACP
InterlockedIncrement
GetCPInfo
HeapDestroy
GetModuleHandleA
FlushFileBuffers
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
HeapCreate
GetUserDefaultLCID
GetStringTypeW
GetLocaleInfoW
GetSystemTimeAsFileTime
GlobalFree
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetConsoleMode
GetConsoleCP
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetCurrentThreadId
SetLastError
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetFileType
RaiseException
LoadLibraryA
InterlockedExchange
LocalFree
LocalAlloc
TlsFree

user32

GetMessageW
MessageBoxW
SetDlgItemTextW
FindWindowW
MessageBeep
EndDialog
GetDlgItemTextW
DialogBoxParamW
GetSystemMetrics
DispatchMessageW
GetMessageA
MsgWaitForMultipleObjectsEx
PeekMessageW
IsWindowUnicode
TranslateMessage
DispatchMessageA

comdlg32

GetOpenFileNameW

ole32

CoCreateInstance
CoInitialize
CoUninitialize
IIDFromString
OleLoadFromStream
CreateStreamOnHGlobal
GetHGlobalFromStream
OleSaveToStream
StringFromGUID2
CLSIDFromString

oleaut32

SafeArrayCreate
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnlock
SafeArrayRedim
VariantCopyInd
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

116dc207caa218f2740c520ecf7dfb2d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

comdlg32

ole32

oleaut32

Sections

.text Size: 387KB - Virtual size: 386KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 22KB - Virtual size: 99KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 387KB - Virtual size: 386KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 22KB - Virtual size: 99KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 27KB - Virtual size: 27KB