2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

General

Target
2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia
Size 11.5MB
Sample250126-xdarjszjct
SHA256 a7487a3d8d60ef88ef6c8ba1b5b49d453564fc1079c2c5cf8536b6582b5b12f9
MD5 a9c3ea43e06977ad555eb78862b88c6f
SHA1 708c3d914d5451c0de012dc4278fdce821b7ddc9
SHA512 d668c2bd9caf218997c00de69b1e0d264db188d121f5e1cd5d1770498d267335444c12298c3b3c183c9148b85ac1d163dd4be7b0852349707f44f8de1dbd7ba3
SSDEEP 6144:jLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQw:YTYe+D2jFu+iZoUFhAz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

File Explorer

2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

.exe 11.5MB

2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

IMPHASH 81681f8787b6f6eda1666b6ebe54450c
SHA256 a7487a3d8d60ef88ef6c8ba1b5b49d453564fc1079c2c5cf8536b6582b5b12f9
MD5 a9c3ea43e06977ad555eb78862b88c6f
SHA1 708c3d914d5451c0de012dc4278fdce821b7ddc9
SHA512 d668c2bd9caf218997c00de69b1e0d264db188d121f5e1cd5d1770498d267335444c12298c3b3c183c9148b85ac1d163dd4be7b0852349707f44f8de1dbd7ba3
SSDEEP 6144:jLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQw:YTYe+D2jFu+iZoUFhAz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStringTypeExW GetExitCodeProcess Beep GetFileAttributesW GetAtomNameW CreateFileW lstrlenW FindNextVolumeMountPointW IsBadStringPtrA LCMapStringA GetLargestConsoleWindowSize EnumSystemLocalesA LoadLibraryW HeapUnlock VirtualProtectEx BuildCommDCBW GetProcessVersion GetTapeParameters DebugSetProcessKillOnExit SetConsoleTitleW GetProcessShutdownParameters LoadLibraryExA OpenFileMappingW LocalSize GetPrivateProfileSectionW SetFileShortNameW GlobalAlloc GetCurrencyFormatW GetDriveTypeA SetCommTimeouts GetCommandLineA FormatMessageA EnumCalendarInfoExW GetTickCount SetTapeParameters BackupSeek CreateHardLinkA GetUserDefaultLCID GlobalLock GetNamedPipeHandleStateA WriteTapemark MapViewOfFile FindFirstFileW GlobalDeleteAtom GetProcAddress FileTimeToDosDateTime InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InterlockedExchange InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW RaiseException RtlUnwind HeapAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate HeapDestroy GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId GetCurrentThread QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize FatalAppExitA GetACP GetOEMCP IsValidCodePage GetLocaleInfoA IsValidLocale GetStringTypeW HeapReAlloc SetConsoleCtrlHandler FreeLibrary GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile CloseHandle WriteConsoleW SetFilePointer SetStdHandle

advapi32

CloseEventLog GetServiceDisplayNameA GetLengthSid GetSecurityDescriptorSacl RegLoadKeyA AllocateAndInitializeSid RegDeleteValueW LookupPrivilegeValueA DeregisterEventSource EqualSid RegSetValueExA RegRestoreKeyA AddAccessAllowedAceEx SetServiceObjectSecurity AccessCheckAndAuditAlarmW IsValidAcl LookupPrivilegeNameW OpenServiceA GetCurrentHwProfileA GetSecurityDescriptorDacl

Name

.text

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yohol

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pav

Size

1KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11.2MB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2025-01-26_a9c3ea43e06977ad555eb78862b88c6f_mafia

kernel32

advapi32

generic