2024-08-22_eca5db73c23d5c308133942a3abbc021_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-22_eca5db73c23d5c308133942a3abbc021_mafia
Size

3.6MB
MD5

eca5db73c23d5c308133942a3abbc021
SHA1

ff36b2cd455d4120357b83b803f0842b9b77884d
SHA256

4751448867276091ddb1ff1e664bc051318f0eed3466ae9304fa336cedf97451
SHA512

78be7a7c97b3563b25236fa931d665104fd249c7084dd6c04058c3ff3a3aa8ff8d0a0db40402e70cea2f33c964ce13efa666ca0eaf366c9d141e1928e5a97c07
SSDEEP

49152:Sq+XXEzyYWNF2xHvRLUulcKyx+Axdrxa7gIc8xcVgMZr1vHVw7+RLaX2b9YlI:t+n9kxHvRL6+AxdrY7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-22_eca5db73c23d5c308133942a3abbc021_mafia

Files

2024-08-22_eca5db73c23d5c308133942a3abbc021_mafia
.exe windows:5 windows x86 arch:x86

48f1d28bfd92d292693c80389f479436

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\T60\trunk2604\Simulation\Debug\Simulation.pdb

Imports

ventilatory

SimuVtlExec

rs232

?RS232API_SetDelay@@YAXPAEK@Z
?RS232API_Receive@@YAKPAE0K@Z
?RS232API_Send@@YAKPAE0K@Z
?RS232API_Close@@YAXPAE@Z
?RS232API_Open@@YAPAEEKP6AHPAE@Z10@Z
?RS232API_Consult@@YAKPAE0K@Z

interface

?Open@@YAPAXPAD@Z
?Read@@YAPAXKPAXI@Z
?Write@@YAPAXKPAXI@Z
?EventDating@@YAXPAUTIME@@@Z
?PlaySound@@YAXG@Z
?Close@@YAXXZ

alms_simu

?Extinction@@YAXXZ
?CloseWindows@@YAXXZ

winmm

timeGetTime

kernel32

ReleaseMutex
MapViewOfFile
CreateFileMappingA
OutputDebugStringA
TerminateThread
Sleep
ExitThread
SetThreadPriority
CreateThread
SuspendThread
ResumeThread
WriteFile
CreateFileA
CloseHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
HeapDestroy
HeapCreate
SetConsoleCtrlHandler
SetHandleCount
WaitForSingleObject
ReadFile
FatalAppExitA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
VirtualQuery
GetProcessHeap
FreeLibrary
GetLocaleInfoW
IsProcessorFeaturePresent
ExitProcess
HeapSize
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThread
InterlockedDecrement
SetLastError
GetModuleHandleW
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
InterlockedExchange
SetEndOfFile
GetCurrentThreadId
CreateMutexA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
SetFilePointer
EnterCriticalSection
SetStdHandle
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileW
GetModuleFileNameA
RtlUnwind
EncodePointer
DecodePointer
RaiseException
WideCharToMultiByte
IsDebuggerPresent
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryW
HeapAlloc
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetLastError
HeapFree

user32

TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DestroyWindow
DialogBoxParamA
EnableMenuItem
KillTimer
SetWindowTextA
EndDialog
GetWindowLongA
GetWindowDC
GetParent
SetWindowRgn
SetWindowLongA
GetWindowRect
MoveWindow
GetSystemMetrics
wsprintfA
GetMessageA
ClientToScreen
TrackPopupMenu
GetCapture
SetCapture
ReleaseCapture
PostQuitMessage
FillRect
SetTimer
LoadIconA
MessageBoxA
CreateWindowExA
LoadCursorA
RegisterClassExA
DefWindowProcA
BeginPaint
EndPaint
InvalidateRect
GetClientRect
DrawTextA
LoadAcceleratorsA
UpdateWindow
GetSubMenu
LoadMenuA
LoadImageA
ShowWindow

gdi32

GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC
BitBlt
Rectangle
GetObjectA
GetStockObject
SelectObject
GetTextExtentPoint32A
SetTextColor
SetStretchBltMode
CreateSolidBrush
DeleteDC
SetDIBitsToDevice
StretchDIBits

Sections

.textbss
Size: - Virtual size: 781KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

48f1d28bfd92d292693c80389f479436

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ventilatory

rs232

interface

alms_simu

winmm

kernel32

user32

gdi32

Sections

.textbss Size: - Virtual size: 781KB

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 69KB - Virtual size: 359KB

.idata Size: 6KB - Virtual size: 6KB

.rsrc Size: 31KB - Virtual size: 30KB

.reloc Size: 161KB - Virtual size: 161KB

.textbss
Size: - Virtual size: 781KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 69KB - Virtual size: 359KB

.idata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 31KB - Virtual size: 30KB

.reloc
Size: 161KB - Virtual size: 161KB