Static task
static1
Behavioral task
behavioral1
Sample
cfxmafia_loader.exe
Resource
win10v2004-20230703-en
General
-
Target
cfxmafia_loader.exe
-
Size
4.1MB
-
MD5
560a812c47a89f5eabaa84cb0230ddb5
-
SHA1
4b31730bb9db0382bc1e32e1715c4550e2a4a6b7
-
SHA256
b94360a03bde1061fabeaf40d2a8923e06bfba470e5da7dd89036a55f2fd756f
-
SHA512
1aa8596b7990904c593835dc7a32fcb6db98112738adac0d338ef7440c941791695722a606bae8a66d7e6c870dca2d4ef50415da2c13cd5f0f400e42266addee
-
SSDEEP
98304:APUwhdGjDH97jx5zTYfBkk2WJLwlr5qA2qBBRbUz:UUw7GpzTYfBoWJLwFRvVUz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfxmafia_loader.exe
Files
-
cfxmafia_loader.exe.exe windows x64
eecc46fc41dfec245d8fa30c7828c813
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
AreFileApisANSI
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CopyFileW
CreateDirectoryExW
CreateDirectoryW
CreateEventW
CreateFiber
CreateFileW
CreateHardLinkW
CreateSymbolicLinkW
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFiber
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileExW
FindNextFileA
FindNextFileW
FormatMessageA
FreeConsole
FreeLibrary
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableW
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameW
GetLastError
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemTimeAsFileTime
GetTempPathW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MoveFileExW
MultiByteToWideChar
OpenProcess
OutputDebugStringW
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetCurrentDirectoryW
SetEndOfFile
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
SetLastError
SetUnhandledExceptionFilter
SwitchToFiber
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
user32
ClientToScreen
CloseClipboard
CreateWindowExW
DefWindowProcA
DispatchMessageA
EmptyClipboard
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMessageExtraInfo
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowRect
IsWindowUnicode
LoadCursorA
MessageBoxA
MonitorFromWindow
MoveWindow
OpenClipboard
PeekMessageA
RegisterClassExA
ReleaseCapture
ReleaseDC
ScreenToClient
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetProcessDPIAware
SetWindowPos
ShowWindow
TrackMouseEvent
TranslateMessage
UnregisterClassA
UpdateWindow
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1ios_base@std@@UEAA@XZ
??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Xtime_get_ticks
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getsockname
getsockopt
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
send
setsockopt
socket
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrCat
VariantClear
VariantInit
ole32
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
advapi32
DeregisterEventSource
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmEnableBlurBehindWindow
DwmGetColorizationColor
DwmIsCompositionEnabled
bcrypt
BCryptGenRandom
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
wcsstr
api-ms-win-crt-time-l1-1-0
_W_Getdays
_W_Getmonths
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_fileno
_fseeki64
_get_stream_buffer_pointers
_set_fmode
_setmode
_wfopen
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
fsetpos
ftell
fwrite
setvbuf
ungetc
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_dll
_seh_filter_exe
_set_app_type
exit
raise
signal
strerror_s
terminate
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
api-ms-win-crt-string-l1-1-0
_strdup
_stricmp
_strnicmp
isspace
strcat
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strspn
wcslen
api-ms-win-crt-math-l1-1-0
__setusermatherr
acosf
atan2f
ceilf
cosf
fmodf
ldexp
log
logf
pow
powf
sinf
sqrtf
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtol
strtoul
api-ms-win-crt-heap-l1-1-0
_callnewh
_recalloc
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 556KB - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 45B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE