2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia
Size 589KB
Sample240613-ecpj7stbnb
SHA256 dfc416f9cef75ab669f8bfeaccce09e8c847ce6281a54b882c51aeaac56f67f1
MD5 65fd13491a553f4d6b1f2ab022d0d0e1
SHA1 80ec16dae9e0ac0507e73d3e2e746d9e2e2a7f24
SHA512 7b4b317cd096afc4e3d0f664c348c47ffb9388fd29af8ebbdb3028dc30805eba89af68ba6d5e4d387646def0a300044e0a3beb4710b74d6d9ad66afa96008103
SSDEEP 12288:W0KDh2O5FMFeBeSAJDzlA7WrmC90Wz/j1lGG+aPZyPP1riz9D7E:mjEbdy7cmCyWLj1lXDB+P1X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia

File Explorer

2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia

.exe 589KB

2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia

IMPHASH b54f2e304927c6ada2249601a131c88e
SHA256 dfc416f9cef75ab669f8bfeaccce09e8c847ce6281a54b882c51aeaac56f67f1
MD5 65fd13491a553f4d6b1f2ab022d0d0e1
SHA1 80ec16dae9e0ac0507e73d3e2e746d9e2e2a7f24
SHA512 7b4b317cd096afc4e3d0f664c348c47ffb9388fd29af8ebbdb3028dc30805eba89af68ba6d5e4d387646def0a300044e0a3beb4710b74d6d9ad66afa96008103
SSDEEP 12288:W0KDh2O5FMFeBeSAJDzlA7WrmC90Wz/j1lGG+aPZyPP1riz9D7E:mjEbdy7cmCyWLj1lXDB+P1X
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

210330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\delroth\buildslave\release-win-x86\build\Binary\Win32\DSPTool.pdb

winmm

timeEndPeriod timeBeginPeriod timeGetTime

kernel32

GetLastError CreateDirectoryW MoveFileW ReplaceFileW CopyFileW DeleteFileW RemoveDirectoryW FindNextFileW FindClose FindFirstFileW GetModuleFileNameW WideCharToMultiByte MultiByteToWideChar InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection OutputDebugStringA IsDebuggerPresent FormatMessageA GetStdHandle FreeConsole SetConsoleWindowInfo SetConsoleScreenBufferSize GetConsoleScreenBufferInfo WriteConsoleW SetConsoleTextAttribute SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterW SetConsoleTitleW AllocConsole GetConsoleWindow WriteConsoleOutputAttribute WriteConsoleOutputCharacterW ReadConsoleOutputAttribute ReadConsoleOutputCharacterW CreateEventW CloseHandle SetEvent WaitForSingleObject InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange Sleep EncodePointer DecodePointer RaiseException RtlUnwind GetCommandLineA HeapSetInformation FileTimeToSystemTime FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFileType ReadFile SetEndOfFile HeapFree HeapAlloc GetProcessHeap SetEnvironmentVariableA GetCurrentDirectoryA OpenProcess FlushFileBuffers GetDriveTypeW FindFirstFileExW GetFullPathNameA GetFullPathNameW GetSystemTimeAsFileTime VirtualFree GetTimeFormatA GetDateFormatA GetProcAddress GetModuleHandleW ExitProcess LCMapStringW GetCPInfo IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetStartupInfoW HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId SetStdHandle SetFilePointer GetConsoleCP GetConsoleMode CreateFileW GetCurrentDirectoryW HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoW GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeW LoadLibraryW HeapReAlloc CompareStringW VirtualAlloc IsWow64Process SetCurrentDirectoryA GetTimeZoneInformation VirtualProtect

user32

ShowWindow MessageBoxW MoveWindow

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

psapi

GetProcessMemoryInfo

Name

.text

Size

453KB

Virtual Size

453KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_65fd13491a553f4d6b1f2ab022d0d0e1_mafia

winmm

kernel32

user32

advapi32

shell32

psapi

generic