2024-06-28_4edbc04a4c9bbf0708cae3786c8d14b3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-28_4edbc04a4c9bbf0708cae3786c8d14b3_mafia
Size

160KB
MD5

4edbc04a4c9bbf0708cae3786c8d14b3
SHA1

3ebb180322e2fffcf33815663ed89edf7a8c4117
SHA256

b53bf5f5096ba7bc7903e6faf309c792f22a141f3b19651cbe2b95bc5c4350ae
SHA512

d1c1ae57415e2d7de8ee01f37efa61a579cabf5bd42945c9dc29f793888c807c4c216ceec17456bb45178c0b49e52688092df9bfdddf44526fbbb3c1a38212f1
SSDEEP

3072:SGgaZDgJCNencD5Gaq9bVZqqrV6Encj3FMjbtvU1+y/RGh:XgegJr9bV9rbchubJU1b5w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-28_4edbc04a4c9bbf0708cae3786c8d14b3_mafia

Files

2024-06-28_4edbc04a4c9bbf0708cae3786c8d14b3_mafia
.exe windows:5 windows x86 arch:x86

e4e0b20d38c26292b28e7d59160e907e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Q:\script_mgr\src\logtracer\release\logtracer.pdb

Imports

advapi32

ChangeServiceConfig2A

user32

CharNextA
GetMessageA
DispatchMessageA
LoadStringA

ericfmutility

??0IFwkConsoleApp@EricSMUtility@@QAE@XZ
??0CFPMessageQueue@EricSMUtility@@QAE@XZ
??1CFwkThread@EricSMUtility@@UAE@XZ
??0CFwkThread@EricSMUtility@@QAE@P6GKPAX@Z0@Z
?createThread@CFwkThread@EricSMUtility@@QAE_NKK@Z
??1CFPMessageQueue@EricSMUtility@@QAE@XZ
??1IFwkConsoleApp@EricSMUtility@@QAE@XZ
?AddMillisecondsToUpTime@@YAXIPAUFWK_TIMESTAMPtag@@@Z
?CalculateDifference@@YAJUFWK_TIMESTAMPtag@@0@Z
?GetMachineUpTime@@YAXPAUFWK_TIMESTAMPtag@@@Z
??0CFPMessage@EricSMUtility@@QAE@KKKPADUFWK_UNIQUE_ID@@FKPAX@Z
?isEmpty@CFPMessageQueue@EricSMUtility@@QAE_NXZ
?WriteToConsole@IFwkConsoleApp@EricSMUtility@@QAEXJPBD000PAD@Z
?WriteToConsole@IFwkConsoleApp@EricSMUtility@@QAEXPBDPAD@Z
?WriteEventToConsole@IFwkConsoleApp@EricSMUtility@@QAEXPBDPAD@Z
?lock@CFPMessageQueue@EricSMUtility@@QAEXXZ
?push@CFPMessageQueue@EricSMUtility@@QAE_NPAVCFPMessage@2@@Z
?unlock@CFPMessageQueue@EricSMUtility@@QAEXXZ
??1CFPMessage@EricSMUtility@@QAE@XZ
?pop@CFPMessageQueue@EricSMUtility@@QAE_NPAPAVCFPMessage@2@@Z
?InitConsole@IFwkConsoleApp@EricSMUtility@@QAE_NPBD@Z
??0CCommandLineParameter@EricSMUtility@@QAE@XZ
?Parsing@CCommandLineParameter@EricSMUtility@@QAE_NPAD@Z
??1CCommandLineParameter@EricSMUtility@@UAE@XZ
?Delete@CFwkThread@EricSMUtility@@UAEXXZ
?GetMessageID@CFPMessage@EricSMUtility@@QAEKXZ
??1CFwkCriticalSection@EricSMUtility@@QAE@XZ
??0CFwkThread@EricSMUtility@@QAE@XZ
??1CFwkAutoCriticalSection@EricSMUtility@@QAE@XZ
?GetData@CFPMessage@EricSMUtility@@QAEPAXXZ

ericfmfwk

?Start@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEXP6GXKPAPAD@Z@Z
?ServiceMain@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEXKPAPADP6GXK@Z@Z
?Handler@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEXK@Z
?IsInstalled@CFwkAppGlobalObj@EricFlowMgrFramework@@UAE_NXZ
?InitService@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEXPBD@Z
?Uninstall@CFwkAppGlobalObj@EricFlowMgrFramework@@UAE_NXZ
??1CFwkAppGlobalObj@EricFlowMgrFramework@@UAE@XZ
?GetFramework@CFramework@EricFlowMgrFramework@@SAPAV12@XZ
?GetConfigPort@CFwkAppGlobalObj@EricFlowMgrFramework@@QAEKXZ
?SetServiceStatus@CFwkAppGlobalObj@EricFlowMgrFramework@@QAEXK@Z
?UnregisterServer@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEJXZ
?RegisterServer@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEJ_N@Z
?Install@CFwkAppGlobalObj@EricFlowMgrFramework@@UAE_NXZ
??0CFwkAppGlobalObj@EricFlowMgrFramework@@QAE@XZ
??_7CEngineInterface@EricFlowMgrFramework@@6B@
?IsMessageDistributionBySvcName@CEngineInterface@EricFlowMgrFramework@@UAE_NXZ
?PushMessageToEngine@CEngineInterface@EricFlowMgrFramework@@UAE_NKKQAD0UFWK_UNIQUE_ID@@KFKPAXJ@Z
?NotifyShutdown@CFwkAppGlobalObj@EricFlowMgrFramework@@QAE_NXZ
?LogEvent@CFwkAppGlobalObj@EricFlowMgrFramework@@QAAXPBDZZ
?Term@CFwkAppGlobalObj@EricFlowMgrFramework@@UAEXXZ

ericfmdocreader

?registerDynAttribute@ICFGPublisherImpl@DocReaderUtil@@UAEIPBDAAV?$CFGCallbackAdapter@VICFGSubscriber@DocReaderUtil@@PAXPBDKPAX@2@@Z
?unRegisterDynAttribute@ICFGPublisherImpl@DocReaderUtil@@UAE_NPBDI@Z
?unRegisterDynAttribute@ICFGPublisherImpl@DocReaderUtil@@UAE_NPBD@Z

ericfmlogging

?SetFileSizeLimit@CArchLogData@FMLoggingUtil@@QAEXK@Z
?SetNumberOfFiles@CArchLogData@FMLoggingUtil@@QAEXK@Z
?ErrorLog@CArchLogData@FMLoggingUtil@@QAEXPBD@Z
?fwklog@CArchLogData@FMLoggingUtil@@QAEXPBDPAD@Z
?GetInstance@CLogArch@FMLoggingUtil@@SAPAV12@XZ
?SetFunctionalLevel@CLogArch@FMLoggingUtil@@QAEXPBD@Z
?LogWithArgument@CLogArch@FMLoggingUtil@@QAEXHPBD000PAD@Z
?DumpBuffer@CArchLogData@FMLoggingUtil@@QAEXXZ
?SetLogService@CLogArch@FMLoggingUtil@@QAEXPAVCArchLogData@2@@Z
?ResetAllSubscription@CLogArch@FMLoggingUtil@@QAEXXZ
?SetFunctionalLevelSubscription@CLogArch@FMLoggingUtil@@QAE_NPBDPAVICFGPublisher@DocReaderUtil@@@Z
?SetLogLevelSubscription@CLogArch@FMLoggingUtil@@QAE_NPBDPAVICFGPublisher@DocReaderUtil@@@Z
??1CArchLogData@FMLoggingUtil@@QAE@XZ
?SkipRequestLevel@CLogArch@FMLoggingUtil@@QAEX_N@Z
?GetLogLevel@CArchLogData@FMLoggingUtil@@SAXHPAD@Z
??0CArchLogData@FMLoggingUtil@@QAE@PBD0K0KHHGK@Z
?SetModule@CLogArch@FMLoggingUtil@@QAEXPBD@Z
?SetLogLevel@CLogArch@FMLoggingUtil@@QAEXH@Z
?LogMsg@CArchLogData@FMLoggingUtil@@QAEXKPBD@Z

ericcfgfmpdu

?getLoggingPort@CCfgFmSysParam@ERIC_CFGFMpdu@@QBEGXZ
?getMaxLogFileSize@CCfgFmSysParam@ERIC_CFGFMpdu@@QBEKXZ
?getMaxLogFiles@CCfgFmSysParam@ERIC_CFGFMpdu@@QBEKXZ
?getFunctionalLevel@CCfgFmLogParam@ERIC_CFGFMpdu@@QBEPBDXZ
?getReportInterval@CCfgFmSysParam@ERIC_CFGFMpdu@@QBEKXZ
?getLogLevel@CCfgFmLogParam@ERIC_CFGFMpdu@@QBEKXZ

ericcfgfmrequestor

?notifyRequestTimeout@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NPAVIFwkRequestRecord@EricSMUtility@@@Z
?setStatus@CCfgRequestor@FM_CONFIG_UTIL@@MAEXW4SM_CFG_STATE@2@@Z
?startThread@CCfgRequestor@FM_CONFIG_UTIL@@MAE_NXZ
?stopThread@CCfgRequestor@FM_CONFIG_UTIL@@MAE_NXZ
?closeThread@CCfgRequestor@FM_CONFIG_UTIL@@MAEXXZ
?notifyShutdown@CCfgRequestor@FM_CONFIG_UTIL@@MAEXXZ
?isStopped@CCfgRequestor@FM_CONFIG_UTIL@@MAE_NXZ
?addRequestTimeout@CCfgRequestor@FM_CONFIG_UTIL@@MAE_NAAK0PAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?waitForResponse@CCfgRequestor@FM_CONFIG_UTIL@@MAEHKPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@K@Z
?wait@CCfgRequestor@FM_CONFIG_UTIL@@MAEHPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@K_N@Z
?onUniversalFailure@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onOpenResponse@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?Handling@CCfgRequestor@FM_CONFIG_UTIL@@UAEXXZ
?getSvcApp@CCfgFmConfigHandler@FM_CONFIG_UTIL@@UAEHKPBDAAVCCfgFmSvcAppInfo@ERIC_CFGFMpdu@@@Z
?changeRequest@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAEHPAVCCfgFmPDU@ERIC_CFGFMpdu@@AAW4CFG_FM_ERROR_MESSAGES@@@Z
?onChangeLogSetting@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeSystemParameter@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeSvc@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?isnotConnected@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?onChangeTenant@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onEnableTenant@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeLicenseScheme@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeSvcApp@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onEnableSvcApp@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onReactivateSvcApp@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onUpdateSAPriorities@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeAMSParameter@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeOASSite@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeASMSParameter@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeSMSSite@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeAppMessagingParameter@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeCCBrokerInfo@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeLicenseInfo@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onChangeObtainedLicenseInfo@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
??1CCfgFmConfigHandler@FM_CONFIG_UTIL@@UAE@XZ
?initialize@CCfgFmConfigHandler@FM_CONFIG_UTIL@@QAEHXZ
?setName@CCfgFmConfigHandler@FM_CONFIG_UTIL@@QAEXPBD0@Z
?getLogDirectory@CCfgFmConfigHandler@FM_CONFIG_UTIL@@QAEPBDXZ
?isclosed@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?isconnected@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?closeConnection@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?openConnection@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?init@CCfgRequestor@FM_CONFIG_UTIL@@UAE_NXZ
?setHost@CCfgRequestor@FM_CONFIG_UTIL@@UAEXPBDH@Z
?makeRequest@CCfgRequestor@FM_CONFIG_UTIL@@UAEHPAVCCfgFmPDU@ERIC_CFGFMpdu@@PAPAV34@K@Z
??0CCfgFmConfigHandler@FM_CONFIG_UTIL@@QAE@XZ
?onChangeDependentSvc@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z
?onEventHandling@CCfgFmConfigHandler@FM_CONFIG_UTIL@@MAE_NPAPAVCCfgFmPDU@ERIC_CFGFMpdu@@@Z

kernel32

IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
HeapReAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
FatalAppExitA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
HeapSize
Sleep
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcAddress
GetCurrentThread
InterlockedDecrement
SetLastError
GetModuleHandleW
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
HeapFree
GetLastError
HeapAlloc
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RaiseException
RtlUnwind
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateSemaphoreA
CreateEventA
CloseHandle
WaitForMultipleObjects
WaitForSingleObject
TerminateThread
SetEvent
ReleaseSemaphore
GetCurrentThreadId
GetComputerNameA
GetCurrentProcessId
GetCommandLineA
lstrcmpiA

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4e0b20d38c26292b28e7d59160e907e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

user32

ericfmutility

ericfmfwk

ericfmdocreader

ericfmlogging

ericcfgfmpdu

ericcfgfmrequestor

kernel32

Sections

.text Size: 114KB - Virtual size: 113KB

.rdata Size: 32KB - Virtual size: 31KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 114KB - Virtual size: 113KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB