2024-06-13_5fe699358281e052f32f7546e255976e_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-13_5fe699358281e052f32f7546e255976e_mafia
Size

286KB
MD5

5fe699358281e052f32f7546e255976e
SHA1

6befac3880ce220d64d60af5d51209cd4e6e710f
SHA256

4fa90e2df6f94c52f163e0a889483f8bf4a27649ea51c50dadf98e1a804ae556
SHA512

ca216504c8601669d759d89156abdbad8ee388008c9d530557c6e39242e43af423efa04d57cc730650e82f6d29ebbeb1132373cdf3377b4b8b9eaefaecfca979
SSDEEP

3072:QUWCQShDsLXFJHeerjb6oo+GiDCgthJQeu3twuFa3bSvJClHZVl6mp10cE36ntFU:3GHHea7o+Gi/Qeu3tll8lflZ7BOTo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_5fe699358281e052f32f7546e255976e_mafia

Files

2024-06-13_5fe699358281e052f32f7546e255976e_mafia
.exe windows:5 windows x86 arch:x86

bbe54fb3fab03fcc53dd4705d6d3ba23

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\build\bamboo-agent-home\xml-data\build-dir\VRM-V0300-JOB1\source\bin\dbconverter.pdb

Imports

kernel32

EnterCriticalSection
DeleteCriticalSection
GetProcessHeap
SetEndOfFile
CreateFileW
InitializeCriticalSection
CreateFileA
SetStdHandle
WriteConsoleW
CreateProcessA
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
SetEnvironmentVariableA
LeaveCriticalSection
FlushFileBuffers
SetFilePointer
ReadFile
GetConsoleMode
GetCurrentProcessId
CloseHandle
SetThreadPriority
OpenThread
Sleep
GetCurrentThreadId
InterlockedIncrement
RaiseException
InterlockedDecrement
TryEnterCriticalSection
CreateSemaphoreA
ReleaseSemaphore
WaitForSingleObject
InterlockedExchange
EncodePointer
DecodePointer
RtlUnwind
GetLastError
HeapFree
HeapReAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
MoveFileA
GetCommandLineA
HeapSetInformation
ExitThread
CreateThread
HeapAlloc
CompareStringW
MultiByteToWideChar
GetCPInfo
WideCharToMultiByte
LCMapStringW
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
InitializeCriticalSectionAndSpinCount
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetLocaleInfoW
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetFileAttributesA
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP

qdbm

vstcurlast
vstcurjump
vstcurnext
vstcurprev
vstcurkeycache
vstcurvalcache
vstcurput
vstcurout
vstgetcache
vstput
vstout
vstclose
vstoptimize
vstsettuning
vstopen
VST_CMPLEX
vstcurfirst

iphlpapi

GetAdaptersInfo

ws2_32

WSAAddressToStringA
inet_addr
inet_ntoa

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

libxml2

xmlDocDumpFormatMemory
xmlCheckVersion
xmlReadMemory
xmlCleanupParser
xmlParseDoc
xmlDocGetRootElement
xmlDocCopyNodeList
xmlAddChildList
xmlFreeNodeList
xmlFreeDoc
xmlNewTextChild
xmlNewChild
xmlSetProp
xmlUnsetProp
xmlUnlinkNode
xmlNodeSetContent
xmlEncodeEntitiesReentrant
xmlGetProp
xmlXPathObjectCopy
xmlXPathFreeObject
xmlXPathFreeContext
xmlXPathEvalExpression
xmlXPathNewContext
xmlHasProp
xmlFree

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbe54fb3fab03fcc53dd4705d6d3ba23

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

qdbm

iphlpapi

ws2_32

advapi32

libxml2

Sections

.text Size: 232KB - Virtual size: 231KB

.rdata Size: 35KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 15KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 11KB - Virtual size: 10KB

.text
Size: 232KB - Virtual size: 231KB

.rdata
Size: 35KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 15KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 11KB - Virtual size: 10KB