2024-08-19_3e6cf9201412aced07e2b420ce56dd72_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-08-19_3e6cf9201412aced07e2b420ce56dd72_mafia
Size

441KB
MD5

3e6cf9201412aced07e2b420ce56dd72
SHA1

77c73a73170fd15b2e3aed9ddd16037e798e439b
SHA256

54258aa434831287faa995eff131af705ea5525e7f67da1703897dcfdb6ca674
SHA512

6972d6fa07f5db73fd2083b165fd5aec3c271c032384270f57139808ec5312a0ebad1b857e59b94d70787c3d0a6879ff673fc28496b540b2b3d55675f9f2676c
SSDEEP

6144:MQiVyHPFLfH6E3ohyOAEPnDvrvJEfHQ0DuDM8a1QSSyR67uZO4X0ftGEL7oph7Xy:MQfH9BohA8nDTP61QhuZOGaF43dJ7G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-19_3e6cf9201412aced07e2b420ce56dd72_mafia

Files

2024-08-19_3e6cf9201412aced07e2b420ce56dd72_mafia
.exe windows:5 windows x86 arch:x86

c26c23c59361399507b4e90bdcf16902

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\bamboo\xml-data\build-dir\SAG-SAGTNIGHT-WIN\Projects\nrfjprog\nrfjprogexe\Release\nrfjprog.pdb

Imports

kernel32

GetModuleFileNameA
LoadLibraryA
GetProcAddress
FreeLibrary
CompareStringW
GetProcessHeap
SetEndOfFile
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
HeapFree
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
GetModuleHandleW
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
HeapCreate
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
LoadLibraryW
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
SetStdHandle
WriteConsoleW
CreateFileA
CreateFileW
SetEnvironmentVariableA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shlwapi

PathFileExistsA
PathRemoveFileSpecA

Sections

.text
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 183KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c26c23c59361399507b4e90bdcf16902

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shlwapi

Sections

.text Size: 197KB - Virtual size: 197KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 183KB - Virtual size: 191KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 197KB - Virtual size: 197KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 183KB - Virtual size: 191KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 13KB - Virtual size: 12KB