Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10_43c3f0d992e14a3f04528efac5a7cac0_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-10_43c3f0d992e14a3f04528efac5a7cac0_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-10_43c3f0d992e14a3f04528efac5a7cac0_mafia
-
Size
374KB
-
MD5
43c3f0d992e14a3f04528efac5a7cac0
-
SHA1
75e258568da90fc9191368e14833719cc984b055
-
SHA256
44d4238747347aa5e84c636e6f13e6f73880c0408019740654bf8dbafaccd726
-
SHA512
f1e60447a53f8e92d9425dd6457577458233ea2f9c282789eee78f7393ea506cce70a73a38a67cea58df01236c2dc614a1ac2d46f4c6f0fa3f6b493e24ea614f
-
SSDEEP
6144:Q2TL+j2FSNit13oeMftbnIdGff2p2VY5oAOT3d8:Q2TL+K1+ftbkGff2MVYev
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-10_43c3f0d992e14a3f04528efac5a7cac0_mafia
Files
-
2024-01-10_43c3f0d992e14a3f04528efac5a7cac0_mafia.exe windows:5 windows x86 arch:x86
3ed0345ddc677640306cb6b2a10cd8f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
bcrypt
BCryptFreeBuffer
BCryptEnumAlgorithms
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptDestroyKey
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptSetProperty
BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
ncrypt
NCryptFreeBuffer
NCryptEnumKeys
NCryptFreeObject
NCryptOpenStorageProvider
NCryptDeleteKey
NCryptOpenKey
NCryptGetProperty
NCryptExportKey
NCryptEncrypt
NCryptDecrypt
NCryptSignHash
NCryptDeriveKey
NCryptSecretAgreement
NCryptImportKey
NCryptFinalizeKey
NCryptSetProperty
NCryptCreatePersistedKey
NCryptVerifySignature
ws2_32
gethostname
socket
bind
ioctlsocket
WSAStartup
closesocket
WSACleanup
getaddrinfo
freeaddrinfo
getnameinfo
setsockopt
htonl
htons
ntohs
WSAIoctl
select
__WSAFDIsSet
sendto
ntohl
WSAGetLastError
iphlpapi
GetAdaptersAddresses
kernel32
CompareStringW
CreateFileW
GetDriveTypeW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
LCMapStringW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapSize
RtlUnwind
RaiseException
WriteConsoleW
GetTimeZoneInformation
FlushFileBuffers
GetModuleFileNameW
GetLocaleInfoW
LoadLibraryW
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableA
GetFileInformationByHandle
InterlockedExchange
GetProcessHeap
SetEndOfFile
SetStdHandle
FatalAppExitA
Sleep
DeleteCriticalSection
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
PeekNamedPipe
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
FormatMessageA
CreateMutexA
CloseHandle
ReleaseMutex
WaitForSingleObject
GetLastError
GetFullPathNameA
GetDiskFreeSpaceExA
FreeLibrary
LoadLibraryA
SetFileAttributesA
MoveFileA
CreateProcessA
GetStartupInfoA
GetEnvironmentVariableA
SetConsoleCtrlHandler
SetPriorityClass
GetCurrentProcess
GetCurrentProcessId
HeapFree
EnterCriticalSection
LeaveCriticalSection
DuplicateHandle
GetFileType
CreateFileA
FindClose
FileTimeToSystemTime
GetDriveTypeA
FindFirstFileExA
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
DeleteFileA
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapAlloc
CreateDirectoryA
RemoveDirectoryA
FindNextFileA
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
EncodePointer
GetCommandLineA
HeapSetInformation
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
Sections
.text Size: 281KB - Virtual size: 281KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ