E:\pre_i18_per_to_202007_061\Build\Release\WPSOffice\wtoolex\updateself.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-24_b9c84c3ea657247e6ebce809a8fa1017_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-24_b9c84c3ea657247e6ebce809a8fa1017_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-24_b9c84c3ea657247e6ebce809a8fa1017_mafia
-
Size
1.3MB
-
MD5
b9c84c3ea657247e6ebce809a8fa1017
-
SHA1
af3265122dcf1e16851ef0c83859ff03de03acb5
-
SHA256
5aad78a7219c67a7a863e9d0e494c182f80a318de3a7f5e3c65354374f0ded95
-
SHA512
a592778802fa7af31679cffdc35a704fe54d7fe700e10a191e7e526fde3a0c5ec5ca7d679b8dbe596ca466c71fdc3ab603f7f4705309ebf48fd5575fe7532267
-
SSDEEP
24576:i6cDtdda81uqgma9kf2M9jRFEM4XlhafCLTmJe1D90ZL+ZOjnZ1rgK+q2FV:iTtTa81ugMMulFnmJe1J0ZL+8z89/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-24_b9c84c3ea657247e6ebce809a8fa1017_mafia
Files
-
2024-08-24_b9c84c3ea657247e6ebce809a8fa1017_mafia.exe windows:5 windows x86 arch:x86
5df414f973933ae88231b7b412f6e16d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetCurrentProcess
GetCurrentThread
CloseHandle
GetLastError
GetVersionExW
SetLastError
InterlockedDecrement
LocalFree
GetSystemDirectoryW
GetSystemWow64DirectoryW
GetProcAddress
LoadLibraryW
GetDateFormatW
GetTimeFormatW
GetVersion
FreeLibrary
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrlenW
OpenProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
GetFileAttributesW
GetUserDefaultLCID
IsWow64Process
GetCommandLineW
lstrlenA
Sleep
ExpandEnvironmentStringsW
DeleteFileW
FindClose
GetModuleHandleW
GetModuleFileNameW
RemoveDirectoryW
FindNextFileW
MoveFileExW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GlobalFree
WaitForSingleObject
WriteFile
CreateFileW
GetModuleHandleA
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
GetCurrentProcessId
GetExitCodeProcess
CopyFileW
CreateEventW
ResetEvent
SetEvent
ResumeThread
InterlockedExchange
SetFilePointer
GetTickCount
ReadFile
MoveFileW
GetExitCodeThread
CreateThread
GetFileAttributesExW
ReleaseMutex
OutputDebugStringW
GetCurrentThreadId
GetFileSize
CreateMutexW
SetFileAttributesW
GetPrivateProfileSectionW
LocalAlloc
RaiseException
GetUserDefaultUILanguage
DeviceIoControl
CreateFileA
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
SleepEx
QueryPerformanceCounter
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FormatMessageA
GetSystemTime
InterlockedIncrement
GetStringTypeW
InterlockedCompareExchange
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindFirstFileExW
GetDriveTypeA
ExitThread
GetFileInformationByHandle
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetDriveTypeW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
GetFileAttributesA
Sections
.text Size: 538KB - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 604KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE