Static task
static1
Behavioral task
behavioral1
Sample
2024-01-09_337eb10e84de4980f2cd0f9d68badb1e_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-09_337eb10e84de4980f2cd0f9d68badb1e_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-09_337eb10e84de4980f2cd0f9d68badb1e_mafia
-
Size
257KB
-
MD5
337eb10e84de4980f2cd0f9d68badb1e
-
SHA1
076bd34d98789642f0372a11c8764caf7aa51d50
-
SHA256
35346e9c61d4ba2953d0c04a23e927855dccfab2ef619ec47f63635adb670f56
-
SHA512
e9e9edcf6f310609220bc742f5102e5d703db1a97194d623fa63c16cb6de69aa3d960a94ddb9c8647d60fc3d41dceee3baa213381fc80a554035bac9e45e5c21
-
SSDEEP
6144:nCEgOZk0cU/1ZMuo3a0k+iqgw4uMHKdhXo6:CEgJ0Ziq0k+iqgwW4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-09_337eb10e84de4980f2cd0f9d68badb1e_mafia
Files
-
2024-01-09_337eb10e84de4980f2cd0f9d68badb1e_mafia.exe windows:5 windows x86 arch:x86
410dfe79e53d5b5097496afcdf2fa839
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
kernel32
GetLastError
SetLastError
CreateProcessW
GetModuleFileNameW
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
RaiseException
GetCurrentThreadId
Sleep
GetCurrentProcess
IsDebuggerPresent
LocalFree
GetCommandLineW
HeapSetInformation
GetProcAddress
GetModuleHandleW
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
GetUserDefaultLangID
ExpandEnvironmentStringsW
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
GetVersionExW
InterlockedExchangeAdd
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
ReleaseMutex
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedIncrement
InterlockedExchange
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
InitializeCriticalSection
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
GetConsoleCP
GetConsoleMode
ExitProcess
HeapReAlloc
HeapAlloc
RtlUnwind
LCMapStringW
HeapCreate
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
GetStringTypeW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
WaitForSingleObject
CloseHandle
GetTickCount
GetCurrentProcessId
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
GetDriveTypeW
GetCPInfo
GetTempPathW
GetFileAttributesW
LoadLibraryA
LocalAlloc
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CreateProcessAsUserW
oleaut32
SysAllocString
SysFreeString
user32
MessageBoxW
Sections
.text Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ