2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia
Size 4.5MB
Sample240613-py47wstbpq
SHA256 11f8f78c5ca779ef4a8fcb1d5aeff1cbe6f387d2060ab35f0db02a0e377a19a6
MD5 c636a94b5a2ea2f041f746ef0974f95a
SHA1 18f40ee1026d588d702f97c8311cc523d7551678
SHA512 3baea5b97a9c4bdf132f275a1a2ddd832817037e5b51e3da6f57968fcaa797c1f6976d5729312f2a9a6791d4fd05a7d3f26feaf5bb32f1a3c5eef9f5b1139ab9
SSDEEP 98304:3cxg3inz9B7VzuoK3iz4Rd+4htFrspl0lA6fjPXazH37W:3cxg3iJBYR3Da4hrrspl0lTjPXazXa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia

File Explorer

2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia

.exe 4.5MB

2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia

IMPHASH 2c249b0e6e58031d6f455ddf67bc0098
SHA256 11f8f78c5ca779ef4a8fcb1d5aeff1cbe6f387d2060ab35f0db02a0e377a19a6
MD5 c636a94b5a2ea2f041f746ef0974f95a
SHA1 18f40ee1026d588d702f97c8311cc523d7551678
SHA512 3baea5b97a9c4bdf132f275a1a2ddd832817037e5b51e3da6f57968fcaa797c1f6976d5729312f2a9a6791d4fd05a7d3f26feaf5bb32f1a3c5eef9f5b1139ab9
SSDEEP 98304:3cxg3inz9B7VzuoK3iz4Rd+4htFrspl0lA6fjPXazH37W:3cxg3iJBYR3Da4hrrspl0lTjPXazXa
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

370439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\nsis2\src\build\urelease\stub_lzma\stub_lzma.pdb

kernel32

CloseHandle SetFileTime SetEndOfFile SetFilePointer CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount HeapAlloc GetModuleFileNameW GetProcAddress TerminateProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode UnregisterWaitEx GetCurrentProcessId GetCurrentThreadId OutputDebugStringW lstrcpynA lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread RegisterWaitForSingleObject GetEnvironmentVariableW CreateEventW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetSystemDirectoryW GetSystemTimeAsFileTime InterlockedExchange OpenProcess lstrcpyW LoadLibraryA GetVersionExW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA SetConsoleCtrlHandler FileTimeToLocalFileTime SetConsoleMode GetConsoleMode GetStdHandle DeleteCriticalSection lstrcmpiW LeaveCriticalSection LocalFree FormatMessageW GetCurrentDirectoryW SetLastError FindCloseChangeNotification FindFirstChangeNotificationW GetLogicalDriveStringsW FileTimeToSystemTime WaitForMultipleObjects SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore InitializeCriticalSection EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW LCMapStringW CreateFileA WriteConsoleW SetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP FatalAppExitA GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount HeapSize GetLocaleInfoW IsProcessorFeaturePresent VirtualQuery HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentThread InterlockedDecrement InterlockedIncrement IsValidLocale TlsFree TlsSetValue TlsGetValue TlsAlloc GetStartupInfoW HeapSetInformation HeapReAlloc RtlUnwind EncodePointer DecodePointer RaiseException ExitThread lstrcmpW GlobalFree ExpandEnvironmentStringsW GlobalAlloc GetExitCodeProcess LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA WriteFile MultiByteToWideChar FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv SetDllDirectoryW LoadLibraryW GetModuleHandleW GetCurrentProcess VirtualAlloc VirtualFree WaitForSingleObject GetFileSize ReadFile GetProcessHeap EnterCriticalSection HeapFree

user32

CharPrevW CharUpperW CharNextA MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW wvsprintfW SystemParametersInfoW DispatchMessageW GetClassInfoW DialogBoxParamW SetWindowPos EndPaint DrawTextW FillRect GetClientRect BeginPaint DefWindowProcW SendMessageW InvalidateRect EnableWindow PeekMessageW CreateWindowExW wsprintfA CharPrevExA CharLowerW CharToOemW RegisterClassW DestroyWindow IsWindowEnabled SetClassLongW GetDC LoadImageW SetWindowLongW CallWindowProcW GetSystemMenu EnableMenuItem CreateDialogParamW EndDialog GetSystemMetrics CreatePopupMenu AppendMenuW GetWindowRect TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard LoadBitmapW IsWindowVisible GetMessagePos ScreenToClient IsDlgButtonChecked GetAsyncKeyState CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW ExitWindowsEx SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem

gdi32

SetBkColor GetDeviceCaps CreateBrushIndirect DeleteObject SelectObject SetTextColor CreateFontIndirectW SetBkMode

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetSpecialFolderLocation ShellExecuteW SHFileOperationW SHGetFileInfoW

advapi32

RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumValueW RegOpenKeyExW RegEnumKeyW RegCloseKey RegDeleteKeyW

comctl32

ImageList_Destroy ImageList_AddMasked ImageList_Create ord17

ole32

OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

oleaut32

SysAllocStringByteLen VariantCopy VariantClear SysFreeString SysAllocString

psapi

GetModuleInformation

dnsapi

DnsQuery_A DnsFree

ws2_32

inet_addr htonl inet_ntoa

iphlpapi

GetPerAdapterInfo GetAdaptersInfo

Name

.text

Size

550KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

367KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_c636a94b5a2ea2f041f746ef0974f95a_mafia

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

oleaut32

psapi

dnsapi

ws2_32

iphlpapi

generic