2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit

Sharing

Copy URL

Twitter E-mail

General

Target

2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit
Size

1.2MB
MD5

11e7b8e829e762907a4b18ba6674b31b
SHA1

e4b6838aebc9f5fc10047e8d4c59106c52754e1b
SHA256

08112a21af245b130c3cac6617cd5a89e8d1e9631e0bc45c381da9515e9dce3c
SHA512

44960b4113c67767f25d038ac7c1eed3017d72fa440ffcd2f329eb7ec27f926e15ec4f15b53e5402104c4cc8c1767a436978451ef20e8efd44494dd9d2d461f2
SSDEEP

24576:2h2bNeMrpYdvrqUGvUk5jxHJ/6+85kKLj8TjWoY0eClVy23c9oMI8rFi2Pdr7R58:AcNTmRqUGvUk5jxHJ/6+85kKLj8TjW04

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit

Files

2024-11-01_11e7b8e829e762907a4b18ba6674b31b_mafia_ramnit
.exe windows:5 windows x86 arch:x86

cb050e637d821754f3f14e2e8a190604

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDisposeImage
GdipCreateBitmapFromGdiDib
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCloneImage
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipDeleteGraphics
GdipDeleteBrush
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipFree

kernel32

OutputDebugStringW
GetFileAttributesW
QueryPerformanceCounter
GetTickCount
QueryPerformanceFrequency
GetFileSizeEx
GetVersionExW
GetTimeFormatW
GetDateFormatW
GetLastError
GetShortPathNameW
ReadFile
GetFileSize
GlobalFree
MulDiv
MoveFileW
DeleteFileW
WriteFile
RaiseException
InitializeCriticalSectionAndSpinCount
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetProcAddress
GetModuleHandleW
lstrcmpiW
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
CreateMutexW
GetLocaleInfoW
GetThreadLocale
LocalFree
FormatMessageW
CopyFileW
SetFilePointer
CreateDirectoryW
DebugBreak
GetPrivateProfileSectionW
GetPrivateProfileStringW
ExpandEnvironmentStringsW
GetTempPathW
GetCommandLineW
CreateProcessW
VirtualFree
VirtualAlloc
SystemTimeToTzSpecificLocalTime
MoveFileExW
Sleep
LoadLibraryW
GetSystemTime
EncodePointer
DecodePointer
RtlUnwind
InterlockedPopEntrySList
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
LoadLibraryA
InterlockedExchange
LocalAlloc
CreateThread
HeapSetInformation
GetStartupInfoW
FindFirstFileW
SetLastError
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
FindClose
FindNextFileW
GetTimeZoneInformation
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SetFileTime
GetFullPathNameW
InitializeCriticalSection
CreateEventW
EnterCriticalSection
FindFirstChangeNotificationW
LeaveCriticalSection
WaitForMultipleObjects
ResetEvent
FindNextChangeNotification
FindCloseChangeNotification
DeleteCriticalSection
TerminateThread
ResumeThread
SetEvent
WaitForSingleObject
CreateFileW
GetFileTime
CloseHandle
WideCharToMultiByte
FileTimeToSystemTime
InterlockedIncrement
TlsFree
lstrlenA
MultiByteToWideChar
lstrlenW
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetStdHandle
SetHandleCount
GetFileType
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapCreate
GetConsoleCP
GetConsoleMode
GetCurrentProcessId
CreateFileA
GetStringTypeW
CompareStringW
LCMapStringW
HeapReAlloc
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
SetStdHandle
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
ExitThread
WritePrivateProfileStringW
SetEnvironmentVariableW

user32

SetTimer
GetCursorPos
ScreenToClient
KillTimer
MonitorFromPoint
GetSysColor
SetPropW
GetPropW
CallWindowProcW
RemovePropW
ShowWindow
CreateWindowExW
ReleaseCapture
LoadCursorW
SetCursor
SetCapture
EnumDisplayMonitors
CopyRect
SetFocus
EnableWindow
DefWindowProcW
EnumWindows
SendMessageTimeoutW
GetActiveWindow
ShowCursor
DialogBoxParamW
GetWindowTextW
EqualRect
PtInRect
ReleaseDC
GetMenuItemCount
SetCursorPos
IsWindowEnabled
SetMenuItemInfoW
GetSubMenu
DeleteMenu
AppendMenuW
OffsetRect
FillRect
InflateRect
EndPaint
BeginPaint
GetScrollInfo
SetScrollPos
ScrollWindowEx
UpdateWindow
SetScrollInfo
InvalidateRect
GetDC
MoveWindow
DestroyWindow
CharLowerW
GetSystemMetrics
LoadImageW
CharNextW
CharUpperW
ClientToScreen
DestroyMenu
CheckMenuItem
LoadMenuW
IsZoomed
TrackPopupMenu
GetWindowPlacement
SetWindowPlacement
IsClipboardFormatAvailable
GetKeyState
SetWindowLongW
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
EnableMenuItem
CreateDialogParamW
PeekMessageW
GetMenuStringW
SetClassLongW
SetWindowPos
MessageBoxW
GetMenuItemID
GetDlgItem
GetParent
SetWindowTextW
GetWindowLongW
SendMessageW
EndDialog
PostMessageW
SystemParametersInfoW
LoadStringW
EmptyClipboard
OpenClipboard
GetClipboardData
CloseClipboard
SetClipboardData
IntersectRect
IsRectEmpty
UnregisterClassA
DrawTextW

gdi32

SetBkMode
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
Arc
Ellipse
TextOutW
ExtSelectClipRgn
CreateRectRgn
BitBlt
SetROP2
ExtCreatePen
SelectClipRgn
GetTextExtentPoint32W
LineTo
StartDocW
MoveToEx
StartPage
StretchDIBits
EndPage
EndDoc
CreatePen
SetBkColor
ExtTextOutW
IntersectClipRect
CreateDCW
SetMapMode
DPtoLP
DeleteObject
GetStockObject
SelectObject
GetDeviceCaps
CreateFontW
GetTextFaceW
GetTextMetricsW
CreateFontIndirectW
SetDIBitsToDevice
Rectangle
SetTextColor
ExcludeClipRect
DeleteDC
SetViewportOrgEx

winspool.drv

DeviceCapabilitiesW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
PrintDlgExW

advapi32

AllocateAndInitializeSid
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegQueryValueExW
RegGetKeySecurity
GetSecurityDescriptorDacl
GetAclInformation
RegSetValueExW
InitializeAcl
AddAccessAllowedAce
GetAce
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
RegCloseKey
RegOpenKeyExW

shell32

DragFinish
DragQueryFileW
SHFileOperationW
DragAcceptFiles
SHCreateDirectoryExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

VarUI4FromStr

shlwapi

StrCmpLogicalW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

ws2_32

ntohs
htonl

Sections

.text
Size: 887KB - Virtual size: 886KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 163KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb050e637d821754f3f14e2e8a190604

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

ws2_32

Sections

.text Size: 887KB - Virtual size: 886KB

.rdata Size: 163KB - Virtual size: 163KB

.data Size: 9KB - Virtual size: 110KB

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 50KB - Virtual size: 49KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 887KB - Virtual size: 886KB

.rdata
Size: 163KB - Virtual size: 163KB

.data
Size: 9KB - Virtual size: 110KB

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 50KB - Virtual size: 49KB

.rmnet
Size: 56KB - Virtual size: 60KB