2024-09-05_622b35aa06d6b98f0af53a0bf6adc949_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-05_622b35aa06d6b98f0af53a0bf6adc949_mafia
Size

1.6MB
MD5

622b35aa06d6b98f0af53a0bf6adc949
SHA1

b2b57055bea2b92efbe01995fc61adfaab73e9cc
SHA256

1828b6e867ce4ba717127fe422bb7712019026f3ce46cf2a8a1ec0ba67f78945
SHA512

141cf9777f61ac954b546f470e4d897e005c8db3a79b7f1e06e352b445111b332d25ee0d8d68275e72f1bd5660bfad68804ae276f8239ece7e9a5a426de0df10
SSDEEP

49152:aBqgpkb/662eTEkcWna8IdzIpyTsQfRhQ1i:pgs22EkxOdnf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-05_622b35aa06d6b98f0af53a0bf6adc949_mafia

Files

2024-09-05_622b35aa06d6b98f0af53a0bf6adc949_mafia
.exe windows:5 windows x86 arch:x86

db12d03c7628a3a475e3ce02ee7a1819

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

K:\src\kkvsvr\Release\kkvsvr.pdb

Imports

ws2_32

WSASetLastError
htons
shutdown
ntohs
getsockname
bind
listen
accept
WSACleanup
WSAAddressToStringA
WSAStartup
ioctlsocket
connect
select
WSAGetLastError
setsockopt
recv
socket
closesocket
gethostbyname
send
inet_addr

kernel32

GetProcAddress
LoadLibraryA
DeleteFileA
CreateFileA
GetCurrentProcess
lstrcatA
RaiseException
GetCurrentThreadId
OutputDebugStringA
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess
GetTickCount
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
GetVersionExA
GetLastError
FindFirstFileW
CreateProcessW
FindClose
Sleep
LocalFree
GetFileSize
SetFilePointer
SetEndOfFile
WriteFile
ReadFile
CreateFileW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
SetEvent
CreateEventA
ResetEvent
CreateThread
GetEnvironmentVariableA
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
GetSystemDirectoryA
FreeLibrary
GetCurrentProcessId
CloseHandle
DeleteCriticalSection
GetModuleHandleA
GetModuleFileNameA
EnterCriticalSection
ExpandEnvironmentStringsW
InitializeCriticalSection
UnmapViewOfFile
SetHandleCount
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
FlushConsoleInputBuffer
LoadLibraryW
HeapSize
GlobalMemoryStatus
lstrlenA
GetSystemInfo
DeviceIoControl
CancelIo
GetOverlappedResult
WaitForMultipleObjects
GetProcessHeap
GetDriveTypeW
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
SetConsoleMode
ReadConsoleInputA
GetUserDefaultLCID
RtlUnwind
GetTimeZoneInformation
LCMapStringW
SetConsoleCtrlHandler
InterlockedExchange
FindNextFileW
IsValidCodePage
GetOEMCP
WriteConsoleW
GetStringTypeW
GetACP
GetEnvironmentStringsW
FreeEnvironmentStringsW
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
GlobalFindAtomA
GlobalAddAtomA
GetFileType
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
FindResourceA
FreeResource
GetModuleHandleW
GetNativeSystemInfo
GetVersion
QueryPerformanceCounter
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo

user32

SendMessageTimeoutW
EnumWindows
GetWindowTextA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
IsWindowVisible
RegisterWindowMessageA
MessageBoxA

advapi32

OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegSetValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
OpenProcessToken
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA

ole32

OleInitialize

oleaut32

VariantClear
SysAllocString
SysFreeString

shlwapi

SHGetValueA
SHSetValueA

psapi

GetModuleFileNameExA

wininet

InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
HttpQueryInfoW

dbghelp

MiniDumpWriteDump

crypt32

CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore

netapi32

Netbios

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 379KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db12d03c7628a3a475e3ce02ee7a1819

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

wininet

dbghelp

crypt32

netapi32

version

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 379KB - Virtual size: 379KB

.data Size: 108KB - Virtual size: 137KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 69KB - Virtual size: 69KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 379KB - Virtual size: 379KB

.data
Size: 108KB - Virtual size: 137KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 69KB - Virtual size: 69KB