Static task
static1
Behavioral task
behavioral1
Sample
2024-01-06_f98f6e4ecdac8947b60f1c497d989e1e_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-06_f98f6e4ecdac8947b60f1c497d989e1e_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-06_f98f6e4ecdac8947b60f1c497d989e1e_mafia
-
Size
730KB
-
MD5
f98f6e4ecdac8947b60f1c497d989e1e
-
SHA1
2cbd9d62cc8f5a761bc6f295482432f502de1b69
-
SHA256
da36bc915931cc145f49b88d5f98f1a98832d59ec4ffb8b1a09cd6e21e83790b
-
SHA512
73316005defc7f63e4bfdbf0fed79b03a5d6852ad037f77660324ca72987af315c7c6807c3c1e6c35315f7deaaed57bf265e23ec131e1eabeb9c8a2dbec2f8c5
-
SSDEEP
12288:GXLt9jSs/OCeBMif+dgJjzddVKxAXNRdAG4s2OxYIRtuUSjJauY6yqNN3cKB:GXx9o9HsgJjZr9qts5xvuU2Jryq33c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-06_f98f6e4ecdac8947b60f1c497d989e1e_mafia
Files
-
2024-01-06_f98f6e4ecdac8947b60f1c497d989e1e_mafia.exe windows:5 windows x86 arch:x86
36c4b924fbc9ea3a31c6897e32b5df7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
CryptGenRandom
RegSetValueExA
RegEnumKeyExA
CryptAcquireContextA
iphlpapi
DeleteIpForwardEntry
GetIpForwardTable
GetAdaptersInfo
GetAdapterIndex
CreateIpForwardEntry
ws2_32
closesocket
WSAStartup
accept
socket
WSAIoctl
getaddrinfo
freeaddrinfo
__WSAFDIsSet
select
getsockname
connect
send
recv
listen
bind
recvfrom
sendto
getnameinfo
inet_ntoa
inet_addr
ntohs
ntohl
htons
htonl
WSAGetLastError
WSASetLastError
setsockopt
user32
MessageBoxA
kernel32
SetEnvironmentVariableA
CompareStringW
RaiseException
GetProcessHeap
SetEndOfFile
CreateFileW
GetTimeZoneInformation
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetLocaleInfoW
FreeLibrary
HeapQueryInformation
HeapSize
MultiByteToWideChar
LCMapStringW
GetStartupInfoW
SetHandleCount
FatalAppExitA
DeleteCriticalSection
FlushFileBuffers
RtlUnwind
GetConsoleMode
GetConsoleCP
CloseHandle
WaitForSingleObject
CreateProcessA
LocalFree
FormatMessageA
GetLastError
LeaveCriticalSection
EnterCriticalSection
CreateEventA
TlsAlloc
SetLastError
TlsGetValue
SystemTimeToFileTime
GetSystemTime
InitializeCriticalSection
TlsSetValue
GetThreadPriority
DuplicateHandle
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
InterlockedCompareExchange
InterlockedExchange
SetEvent
Sleep
ResumeThread
CreateSemaphoreA
ReleaseSemaphore
ResetEvent
WaitForMultipleObjects
GetTickCount
FlushViewOfFile
GetCurrentProcessId
CreateFileA
GetTempFileNameA
GetTempPathA
GetProcAddress
LoadLibraryA
RtlCaptureStackBackTrace
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetOverlappedResult
WriteFile
GetEnvironmentVariableA
ReadFile
GetVersionExA
MapViewOfFile
UnmapViewOfFile
SetUnhandledExceptionFilter
GetStdHandle
OpenFileMappingA
CreateFileMappingA
DeviceIoControl
HeapFree
HeapAlloc
WriteConsoleW
GetFileType
GetModuleFileNameW
ExitThread
CreateThread
GetModuleHandleW
ExitProcess
DecodePointer
HeapReAlloc
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetCommandLineA
HeapSetInformation
IsProcessorFeaturePresent
EncodePointer
TlsFree
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
HeapCreate
HeapDestroy
LoadLibraryW
WideCharToMultiByte
Sections
.text Size: 574KB - Virtual size: 574KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sysinit_ Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sysunini Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sysctl_s Size: 1024B - Virtual size: 548B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ