2024-09-05_9d482a4d9c161d55eab1f4a14e0cbeb0_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-05_9d482a4d9c161d55eab1f4a14e0cbeb0_mafia
Size

387KB
MD5

9d482a4d9c161d55eab1f4a14e0cbeb0
SHA1

173f6dc5a2dea5a39dd228095b8bd8a5aacea3be
SHA256

633d8c830e3a092094e655a92a6f9da92e71ab65e3d2570b42cb34794a0572c8
SHA512

2dddabe26df94735370e4f8387cdb17c238b4b12145aff9e7f64238b6162ee753ae4b12b797bf12e7eedcb43fb195a9c1bb905e030187ecdbd7204f04b2667af
SSDEEP

6144:8w/kVAHQtx/TFcA3Lwu75fXp+eEP3AKpNEGDX6T7iNVa:8qkE6/jLbTO3AK7EGDqT7EI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-05_9d482a4d9c161d55eab1f4a14e0cbeb0_mafia

Files

2024-09-05_9d482a4d9c161d55eab1f4a14e0cbeb0_mafia
.exe windows:5 windows x86 arch:x86

83182f944785e6c7e486fb492e23a91c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DuplicateTokenEx
CreateProcessAsUserW

wtsapi32

WTSQueryUserToken

kernel32

IsValidLocale
EnumSystemLocalesA
Sleep
GetLastError
CloseHandle
GetProcAddress
LoadLibraryW
FindResourceExW
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlUnwind
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
FreeLibrary
InterlockedExchange
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
FatalAppExitA
LCMapStringW
GetStringTypeW
SetConsoleCtrlHandler
GetLocaleInfoW
SetStdHandle
WriteConsoleW
CreateFileW

wininet

InternetReadFile
HttpOpenRequestA

Sections

.text
Size: 347KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

83182f944785e6c7e486fb492e23a91c

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

wtsapi32

kernel32

wininet

Sections

.text Size: 347KB - Virtual size: 347KB

.rdata Size: 27KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 347KB - Virtual size: 347KB

.rdata
Size: 27KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 31KB - Virtual size: 30KB