2024-08-03_848594072e3e8a5a992b67db01113aa2_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-03_848594072e3e8a5a992b67db01113aa2_mafia
Size

956KB
MD5

848594072e3e8a5a992b67db01113aa2
SHA1

e85115a39acb922b841de7313e444bf4d1272a3c
SHA256

55651bbc1a831c9cc8b7b9c6e97377e3866bf62cc60bd7473d6a06d5c942dc8a
SHA512

342a3605d3fc9e5170d621309d0fcb0084b106719f2c63a1cf8f2f48d3aa4209ae69993664d728d3129a184db4772185090f77dbe2dc13b3e95005373fd970b2
SSDEEP

12288:sQ5cV28x7/8asVDu4qlByrrC2xDkoAuMeeZCqSVGW0MyrgG2Wus7qnuNM1:gp0Du4qlB+9xOuQZCBVGbL2WX7+uNQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-03_848594072e3e8a5a992b67db01113aa2_mafia

Files

2024-08-03_848594072e3e8a5a992b67db01113aa2_mafia
.exe windows:5 windows x86 arch:x86

e084308a123cc64a2055af2eae0281eb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Jenkins\workspace\dev_agent-windows-msma\ConditionMonitoring\ZConRelation\ZConRelation\Release\ZConRelation.pdb

Imports

psapi

EnumProcesses
GetModuleFileNameExA

kernel32

LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetTimeZoneInformation
GetFullPathNameW
GetFullPathNameA
GetCurrentDirectoryW
GetTempPathW
GetModuleFileNameW
MoveFileW
DeleteFileW
GetFileAttributesW
CreateDirectoryW
SetFileAttributesW
GetFileTime
CreateFileW
GetFileAttributesA
GetTempPathA
GetComputerNameA
GetVersionExA
GetFileSize
FlushFileBuffers
DeleteFileA
GetCurrentThreadId
IsBadWritePtr
IsBadReadPtr
CreateMutexA
WaitForSingleObject
CloseHandle
lstrcpyA
lstrcatA
CreateFileA
ReadFile
SetFilePointer
RtlUnwind
InitializeCriticalSection
ReleaseMutex
SetFileAttributesA
lstrlenA
CreateDirectoryA
GetLocalTime
GetLastError
WideCharToMultiByte
MultiByteToWideChar
RaiseException
HeapFree
GetSystemTimeAsFileTime
GetProcessHeap
HeapReAlloc
CompareStringW
WriteConsoleW
SetStdHandle
LoadLibraryW
HeapSize
HeapAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
IsProcessorFeaturePresent
HeapCreate
GetCPInfo
IsValidCodePage
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
ExitProcess
LCMapStringW
GetACP
SystemTimeToFileTime
FileTimeToDosDateTime
GetSystemTime
FileTimeToLocalFileTime
SetEndOfFile
GetCurrentDirectoryA
GetTickCount
GetOEMCP
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
SetEnvironmentVariableA
CreateProcessA
WritePrivateProfileStringA
GlobalFree
SetLastError
GetPrivateProfileStringA
GetModuleFileNameA
GetShortPathNameA
LoadLibraryA
GetProcAddress
lstrlenW
FreeLibrary
InterlockedDecrement
FindFirstFileA
lstrcmpA
FindNextFileA
FindClose
Sleep
MoveFileA
FormatMessageA
LocalFree
GetCurrentProcessId
OpenProcess
WriteFile
lstrcmpiA
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc

advapi32

RegSetValueExA
CryptGenRandom
CryptAcquireContextA
RegCreateKeyExA
CryptReleaseContext
GetUserNameA
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
LookupPrivilegeValueA
AdjustTokenPrivileges

ole32

OleRun
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetElement
SysAllocStringLen
VariantClear
SysAllocString
VariantCopy
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysFreeString
GetErrorInfo
SafeArrayGetUBound

shlwapi

PathFileExistsA
PathRemoveFileSpecA

winhttp

WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpen

Sections

.text
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 282KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e084308a123cc64a2055af2eae0281eb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

advapi32

ole32

oleaut32

shlwapi

winhttp

Sections

.text Size: 483KB - Virtual size: 483KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 282KB - Virtual size: 303KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 108KB - Virtual size: 108KB

.text
Size: 483KB - Virtual size: 483KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 282KB - Virtual size: 303KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 108KB - Virtual size: 108KB