Static task
static1
Behavioral task
behavioral1
Sample
2024-01-09_dcddf116608f0574a75f343c2fa29c00_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-09_dcddf116608f0574a75f343c2fa29c00_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-09_dcddf116608f0574a75f343c2fa29c00_mafia
-
Size
257KB
-
MD5
dcddf116608f0574a75f343c2fa29c00
-
SHA1
974ec1338a265fc531e1e90917f41af0a4286f5f
-
SHA256
382144fba6af938bca5618615611dc7d7b81350e01e6c124762ad0f883d92d52
-
SHA512
9949a0815141f1ba0e6b1f20a2cf18129b6e577cf786965539e16fff3b005d6738bd3e604fe9bcbe60d3caab6b4ed5c30d59cbdae5d165ed5357268fa141c94f
-
SSDEEP
6144:s/EtsSh7J3XQFSiKg7yHgFNy3CMusGrSEi2:2EtsKJ3SJheHgFNy1s2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-09_dcddf116608f0574a75f343c2fa29c00_mafia
Files
-
2024-01-09_dcddf116608f0574a75f343c2fa29c00_mafia.exe windows:5 windows x86 arch:x86
a8fca7d966c6d04b498b9480cfb7489d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
kernel32
CloseHandle
WaitForSingleObject
ReleaseMutex
GetLastError
SetLastError
CreateProcessW
GetModuleFileNameW
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
RaiseException
GetCurrentThreadId
Sleep
IsDebuggerPresent
LocalFree
GetCommandLineW
GetCurrentProcess
HeapSetInformation
GetProcAddress
GetModuleHandleW
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
GetSystemTimeAsFileTime
GetUserDefaultLangID
ExpandEnvironmentStringsW
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
GetVersionExW
InterlockedExchangeAdd
GetTickCount
SetUnhandledExceptionFilter
QueryPerformanceCounter
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedIncrement
InterlockedExchange
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
InitializeCriticalSection
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
GetConsoleCP
ExitProcess
HeapReAlloc
HeapAlloc
GetCPInfo
RtlUnwind
LCMapStringW
HeapCreate
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
GetStringTypeW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
GetCurrentProcessId
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
GetDriveTypeW
GetConsoleMode
GetFileAttributesW
LoadLibraryA
LocalAlloc
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
CreateProcessAsUserW
oleaut32
SysAllocString
SysFreeString
user32
MessageBoxW
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ