Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10_2f8bf870418f865c8febc115b407a760_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-10_2f8bf870418f865c8febc115b407a760_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-10_2f8bf870418f865c8febc115b407a760_mafia
-
Size
176KB
-
MD5
2f8bf870418f865c8febc115b407a760
-
SHA1
c0fe28d3938cd1c483537cc18f07c0133a8f7a0c
-
SHA256
07c5f458c62a416ec42fc924e3e4c6e4ae82445663948b515a5f0ff3deae32b6
-
SHA512
58a9d354ad2bd18b6e44c3c7e98d3aef6977bcb07e702a2cfef4af441a2b994c35400ec29134b20a2730791b54c4368f556f7c87403b2ed4feb85f0594f11b02
-
SSDEEP
3072:U3N4qKw8cMWB67Ls4jzZuT9vSDZqflOcPUBuL2ewAKMe:EkrcMWBsLlZuTmZUOfgL2F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-10_2f8bf870418f865c8febc115b407a760_mafia
Files
-
2024-01-10_2f8bf870418f865c8febc115b407a760_mafia.exe windows:5 windows x86 arch:x86
b51ec0da199cab7fbaeb8b5346662142
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
FindNextFileA
FindClose
GetProcAddress
GetModuleHandleW
ExitProcess
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
CloseHandle
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
GetLocaleInfoW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetStdHandle
WriteConsoleW
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA
CreateFileA
CreateFileW
SetEndOfFile
GetProcessHeap
Sections
.text Size: 131KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ