2024-07-07_0c0a715d6c225e4f8a28d79c9f160bc3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-07_0c0a715d6c225e4f8a28d79c9f160bc3_mafia
Size

358KB
MD5

0c0a715d6c225e4f8a28d79c9f160bc3
SHA1

c63e69f33a48776133f52d1eec8e84b9170c34ce
SHA256

7bc0390e004d471947b904107b3e66cadf366cb0c7f25ee549eaec828f430b0d
SHA512

ef8c8c43b083beec5d568dda85525b44ef9935910f5644b95f827b601fe316df21fbaa799422589c8cc737abbd4f567bad4b76133570dec6a780d44d0c24a7ee
SSDEEP

6144:SiMkR7QH57uTSNkR7KMla4NaG7V1AuJlAtboq2yhu5A2RcRU:SiMkR7QHBLkR7Ta4F7V1AuJlAFoqUA2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-07_0c0a715d6c225e4f8a28d79c9f160bc3_mafia

Files

2024-07-07_0c0a715d6c225e4f8a28d79c9f160bc3_mafia
.exe windows:5 windows x86 arch:x86

90c82ee06c4e5001b88c1a2e686b862e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\SHARED_10.5.0\iA.cwin.Shared\10.5.0-branch\obj\RELEASE\bin\scan\p4cpud.pdb

Imports

kernel32

GetModuleHandleA
SetHandleInformation
GetStdHandle
CreateMutexA
ReleaseMutex
GetCurrentThreadId
GetModuleFileNameA
GetLastError
GetComputerNameA
FindClose
FindFirstFileA
UnlockFileEx
LockFileEx
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetConsoleMode
FormatMessageA
SetConsoleMode
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
SetFileAttributesA
DeleteFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetFullPathNameA
GetDriveTypeW
RemoveDirectoryA
GetDriveTypeA
CreateDirectoryA
GetProcessHeap
SetEndOfFile
CreateFileW
GetTimeZoneInformation
CreateFileA
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
HeapSize
LoadLibraryW
FreeLibrary
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
RtlUnwind
RaiseException
DecodePointer
EncodePointer
MultiByteToWideChar
WideCharToMultiByte
SetStdHandle
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetFileType
GetCommandLineA
HeapSetInformation
InterlockedExchange
ReadFile
GetProcAddress
GetModuleHandleW
ExitProcess
SetConsoleCtrlHandler
CreatePipe
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
MoveFileA
HeapFree
HeapAlloc
HeapReAlloc
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
WriteFile
GetModuleFileNameW
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
FatalAppExitA
Sleep
GetConsoleCP
FlushFileBuffers
GetFileAttributesA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
SetCurrentDirectoryW

advapi32

RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
GetUserNameA

ole32

CoInitialize
CoCreateInstance

unittest_scan

??1GlobalMutex@unittest@@UAE@XZ
?Enter@GlobalMutex@unittest@@UAE_NXZ
??1TestLogger@unittest@@UAE@XZ
?GetTestLogger@TestLogger@unittest@@SAPBV12@XZ
??0GlobalMutex@unittest@@QAE@PBDK@Z
?SetTestLogger@TestLogger@unittest@@SAXPBV12@@Z
??0TestLogger@unittest@@IAE@XZ
?Leave@GlobalMutex@unittest@@UAEXXZ

wsock32

gethostname
WSAGetLastError
recv
send
getpeername
connect
accept
closesocket
getsockname
socket
setsockopt
bind
listen
WSACleanup
WSAStartup
gethostbyaddr
ntohs
htons
getservbyname
htonl
ioctlsocket
gethostbyname

Sections

.text
Size: 293KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90c82ee06c4e5001b88c1a2e686b862e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

ole32

unittest_scan

wsock32

Sections

.text Size: 293KB - Virtual size: 292KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 14KB - Virtual size: 40KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 293KB - Virtual size: 292KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 14KB - Virtual size: 40KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB