mafiaware666 | WindowsFormsApp1[.]exe | Triage

Sharing

General

Target

WindowsFormsApp1.exe
Size

1.3MB
MD5

865a5dfc61b496c6e86abc200bb4916d
SHA1

60b678a4a0032e59a07349e202c4ec42e5a387f8
SHA256

4930e4ddd35a5ef7ad3be161ef88a2fd5f7cf314883af7498573d1ad57824d3c
SHA512

c57b5b06adc462615f26661320f9d2f825e4e4a3d2ea518846b175e1cb89f205b592ccdecec0f9e822cc5521cde25388b271c29164640ff02699a0fc1a30551b
SSDEEP

24576:cTSTiRsBE12BIVpT2QhYpAILUo/g9QZqpMC3QVbIoTdWR8SfEuGujqZF13z8H81:cT7RseZDT2tSbvQsIbe8YVjPH81

Score

10^/10

mafiaware666

Malware Config

Signatures

Detect MafiaWare666 ransomware 1 IoCs

resource	yara_rule
sample	family_mafiaware666

Mafiaware666 family
mafiaware666

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsFormsApp1.exe

Files

WindowsFormsApp1.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Mason Sketch\Desktop\TDN-ransomware-main\EncrypterPOC-main\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ