2024-10-10_e0e12481ada532ee3df9c97cdf54c8e3_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-10_e0e12481ada532ee3df9c97cdf54c8e3_mafia
Size

981KB
MD5

e0e12481ada532ee3df9c97cdf54c8e3
SHA1

a77ecd3d51e2306f39f76025579b5cc1d8adf82b
SHA256

03092246ddb2cd4d81445cfb8ebba0d2ae84d9e8cabf6310fce370ca49f90cc1
SHA512

604abcf39eb4aabdfaea9c1b297dcd9acec180e164791e8e8b16c8863c4bd17e1842ed925196585867c3dbdcacfd2b07cc14bab98bbd5a7767af98c030fe610b
SSDEEP

24576:RLkBfZkpYxAUv0ydldnbJqSULQ5TK7kbUlpvAfjBo4En3TfEguoGik:6BfZkpZ87ckbAIfjgn3T8NoGik

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-10-10_e0e12481ada532ee3df9c97cdf54c8e3_mafia

Files

2024-10-10_e0e12481ada532ee3df9c97cdf54c8e3_mafia
.exe windows:5 windows x86 arch:x86

fc0ca70f22f285018aadb517b8bd0974

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
SetEndOfFile
UnlockFile
LockFile
GetSystemTimeAsFileTime
TlsSetValue
GetVersionExW
GetFileAttributesA
GetFileAttributesW
MultiByteToWideChar
FlushFileBuffers
LockFileEx
TlsAlloc
GetTempPathA
GetSystemTime
DeleteFileA
WTSGetActiveConsoleSessionId
GetLocalTime
OutputDebugStringA
GetDriveTypeW
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetFileSize
CreateProcessW
GetFullPathNameA
GetModuleHandleExW
LocalFree
FreeLibrary
ResumeThread
LoadLibraryW
GetCurrentProcess
GetCurrentProcessId
CreateMutexW
TerminateThread
ExitProcess
GlobalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
CreateEventW
OutputDebugStringW
SetEvent
lstrlenA
TerminateProcess
CreateFileA
SetPriorityClass
DeviceIoControl
SetEnvironmentVariableA
CompareStringW
GetFullPathNameW
GetTempPathW
SetFilePointer
WriteFile
ReadFile
DeleteFileW
CreateFileW
GetLastError
GetPrivateProfileStringA
GetModuleHandleW
GetProcAddress
CloseHandle
lstrlenW
WideCharToMultiByte
Sleep
GetTickCount
GetModuleFileNameW
CreateThread
WaitForSingleObject
GetProcessHeap
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetCPInfo
LCMapStringW
RtlUnwind
GetStdHandle
GetFileType
WriteConsoleW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
GetCommandLineW
HeapSetInformation
FindFirstFileExW
FileTimeToLocalFileTime
HeapAlloc
HeapReAlloc

user32

wsprintfW
KillTimer
MessageBoxA
GetMessageW
DispatchMessageW
SetTimer

advapi32

SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountSidW
GetTokenInformation
OpenProcessToken
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CreateProcessAsUserW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathA
SHGetFolderPathW
ord155
SHGetPathFromIDListW
SHGetFolderLocation

ole32

CoInitializeSecurity
CoInitialize
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoUninitialize

shlwapi

PathFileExistsW

psapi

GetModuleFileNameExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

winhttp

WinHttpSendRequest
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpAddRequestHeaders

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 791KB - Virtual size: 791KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fc0ca70f22f285018aadb517b8bd0974

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

wtsapi32

userenv

winhttp

oleaut32

iphlpapi

Sections

.text Size: 791KB - Virtual size: 791KB

.rdata Size: 127KB - Virtual size: 127KB

.data Size: 15KB - Virtual size: 27KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 44KB

.text
Size: 791KB - Virtual size: 791KB

.rdata
Size: 127KB - Virtual size: 127KB

.data
Size: 15KB - Virtual size: 27KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 44KB