Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_8faf4ba4e961da9a4a9fc08d96a46ae6_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-06_8faf4ba4e961da9a4a9fc08d96a46ae6_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-06_8faf4ba4e961da9a4a9fc08d96a46ae6_mafia
-
Size
274KB
-
MD5
8faf4ba4e961da9a4a9fc08d96a46ae6
-
SHA1
8b18be676eaf041ec608d4a7b3dff1f5961e0d4f
-
SHA256
836566eb6899dbd55c3781356c2c329a33e77ef3f0a483defd33fbafd512ed57
-
SHA512
d7d795b1ade86acde3eb98e952b3b04e47f8167830d8e5d5698a5a97064768754003a7b5369ddc157b3081297d60f5c694b3a6b3aa63ee3b2835ee0a83c64b2f
-
SSDEEP
6144:wYEqbENaaBk4w3EHANTO3luWWMnWjSSyI:VEqaaw20gNTO3luWhh+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-06_8faf4ba4e961da9a4a9fc08d96a46ae6_mafia
Files
-
2024-01-06_8faf4ba4e961da9a4a9fc08d96a46ae6_mafia.exe windows:5 windows x86 arch:x86
a8fca7d966c6d04b498b9480cfb7489d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
kernel32
CloseHandle
WaitForSingleObject
ReleaseMutex
GetLastError
SetLastError
CreateProcessW
GetModuleFileNameW
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
RaiseException
GetCurrentThreadId
Sleep
IsDebuggerPresent
LocalFree
GetCommandLineW
GetCurrentProcess
HeapSetInformation
GetProcAddress
GetModuleHandleW
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
GetSystemTimeAsFileTime
GetUserDefaultLangID
ExpandEnvironmentStringsW
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
GetVersionExW
InterlockedExchangeAdd
GetTickCount
SetUnhandledExceptionFilter
QueryPerformanceCounter
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedIncrement
InterlockedExchange
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
InitializeCriticalSection
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
GetConsoleCP
ExitProcess
HeapReAlloc
HeapAlloc
GetCPInfo
RtlUnwind
LCMapStringW
HeapCreate
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
GetStringTypeW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
GetCurrentProcessId
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
GetDriveTypeW
GetConsoleMode
GetFileAttributesW
LoadLibraryA
LocalAlloc
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CreateProcessAsUserW
oleaut32
SysAllocString
SysFreeString
user32
MessageBoxW
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ