Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_3032c0f0b20182dcec48d9616ca810a7_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-11_3032c0f0b20182dcec48d9616ca810a7_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-11_3032c0f0b20182dcec48d9616ca810a7_mafia
-
Size
631KB
-
MD5
3032c0f0b20182dcec48d9616ca810a7
-
SHA1
7a70d654a842fd0b3d7e38f69c3f5d37aa26f130
-
SHA256
c7fda0d53e2bba7d9434f3b20ef55d2140b45dcf282e58fc1758527291da1aa8
-
SHA512
4e97ec8d8b95550480383b226fd1b986dea27b4cb68117c377ae160f636417bb993a7bfa4a7a8a5e7e3e18e9f7b8a148dd2be63d205e2d2d0b290db84521b03f
-
SSDEEP
12288:suAgaaFu4hW8FbPGwi5A1rU3Xi1YnyTzL2Vm67WllHp7y:daKGH50rU3XczTn2m67QlHp7y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-11_3032c0f0b20182dcec48d9616ca810a7_mafia
Files
-
2024-01-11_3032c0f0b20182dcec48d9616ca810a7_mafia.exe windows:5 windows x86 arch:x86
500126187d0b0395ce1e63829bf8412a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
awesomium
?instance@WebCore@Awesomium@@SAPAV12@XZ
??_7Process@WebViewListener@Awesomium@@6B@
??_7Load@WebViewListener@Awesomium@@6B@
??_7View@WebViewListener@Awesomium@@6B@
??MWebString@Awesomium@@QBE_NABV01@@Z
??0WebString@Awesomium@@QAE@ABV01@@Z
?Undefined@JSValue@Awesomium@@SAABV12@XZ
?Compare@WebString@Awesomium@@QBEHABV12@@Z
?remote_id@JSObject@Awesomium@@QBEIXZ
?SetCustomMethod@JSObject@Awesomium@@QAEXABVWebString@2@_N@Z
?type@JSObject@Awesomium@@QBE?AW4JSObjectType@2@XZ
??0JSValue@Awesomium@@QAE@XZ
?IsUndefined@JSValue@Awesomium@@QBE_NXZ
??0WebString@Awesomium@@QAE@XZ
?Invoke@JSObject@Awesomium@@QAE?AVJSValue@2@ABVWebString@2@ABVJSArray@2@@Z
??0JSValue@Awesomium@@QAE@ABVJSObject@1@@Z
??0WebString@Awesomium@@QAE@PBG@Z
??1JSObject@Awesomium@@QAE@XZ
?ToObject@JSValue@Awesomium@@QAEAAVJSObject@2@XZ
??0JSObject@Awesomium@@QAE@ABV01@@Z
?ToBoolean@JSValue@Awesomium@@QBE_NXZ
?IsBoolean@JSValue@Awesomium@@QBE_NXZ
?IsNumber@JSValue@Awesomium@@QBE_NXZ
??4JSValue@Awesomium@@QAEAAV01@ABV01@@Z
??0JSValue@Awesomium@@QAE@_N@Z
??0JSValue@Awesomium@@QAE@ABV01@@Z
??0JSValue@Awesomium@@QAE@ABVWebString@1@@Z
?Push@JSArray@Awesomium@@QAEXABVJSValue@2@@Z
?WriteDataPak@Awesomium@@YA_NABVWebString@1@00AAG@Z
??1WebPreferences@Awesomium@@QAE@XZ
??0WebKeyboardEvent@Awesomium@@QAE@IIJ@Z
?CopyTo@BitmapSurface@Awesomium@@QBEXPAEHH_N1@Z
?set_is_dirty@BitmapSurface@Awesomium@@QAEX_N@Z
??0WebPreferences@Awesomium@@QAE@XZ
??1WebConfig@Awesomium@@QAE@XZ
?HasProperty@JSObject@Awesomium@@QBE_NABVWebString@2@@Z
??1WebURL@Awesomium@@QAE@XZ
??0WebURL@Awesomium@@QAE@ABVWebString@1@@Z
?Initialize@WebCore@Awesomium@@SAPAV12@ABUWebConfig@2@@Z
??4WebString@Awesomium@@QAEAAV01@ABV01@@Z
??0WebConfig@Awesomium@@QAE@XZ
?Shutdown@WebCore@Awesomium@@SAXXZ
??1View@WebViewListener@Awesomium@@MAE@XZ
??1Load@WebViewListener@Awesomium@@MAE@XZ
??0JSArray@Awesomium@@QAE@XZ
?ToInteger@JSValue@Awesomium@@QBEHXZ
?IsInteger@JSValue@Awesomium@@QBE_NXZ
??_7Menu@WebViewListener@Awesomium@@6B@
?path@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?spec@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?username@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?scheme@WebURL@Awesomium@@QBE?AVWebString@2@XZ
??AJSArray@Awesomium@@QAEAAVJSValue@1@I@Z
?GetProperty@JSObject@Awesomium@@QBE?AVJSValue@2@ABVWebString@2@@Z
??1JSArray@Awesomium@@QAE@XZ
?ToObject@JSValue@Awesomium@@QBEABVJSObject@2@XZ
?GetPropertyNames@JSObject@Awesomium@@QBE?AVJSArray@2@XZ
?IsObject@JSValue@Awesomium@@QBE_NXZ
?ToString@JSValue@Awesomium@@QBE?AVWebString@2@XZ
?data@WebString@Awesomium@@QBEPBGXZ
??AJSArray@Awesomium@@QBEABVJSValue@1@I@Z
?IsString@JSValue@Awesomium@@QBE_NXZ
?size@JSArray@Awesomium@@QBEIXZ
??1WebString@Awesomium@@QAE@XZ
?CreateFromUTF8@WebString@Awesomium@@SA?AV12@PBDI@Z
??1JSValue@Awesomium@@QAE@XZ
??1Process@WebViewListener@Awesomium@@MAE@XZ
??1Menu@WebViewListener@Awesomium@@MAE@XZ
?At@WebMenuItemArray@Awesomium@@QBEABUWebMenuItem@2@I@Z
?size@WebMenuItemArray@Awesomium@@QBEIXZ
?anchor@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?filename@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?host@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?password@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?port@WebURL@Awesomium@@QBE?AVWebString@2@XZ
?query@WebURL@Awesomium@@QBE?AVWebString@2@XZ
wininet
InternetSetOptionW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetCloseHandle
glew32
__GLEW_EXT_texture_filter_anisotropic
glewInit
opengl32
wglDeleteContext
glGetError
glClear
glMatrixMode
glLoadIdentity
glScalef
glBindTexture
glColor4f
glBegin
glTexCoord2f
glVertex3f
glEnd
glFlush
glViewport
glDisable
glClearColor
glVertexPointer
glEnableClientState
glTexCoordPointer
glColorPointer
glEnable
glBlendFunc
glTranslatef
glPushMatrix
wglMakeCurrent
glMultMatrixf
glDeleteTextures
glTexImage2D
glTexParameterf
glGetFloatv
glTexParameteri
glGenTextures
glGetString
wglCreateContext
glTexSubImage2D
glPopMatrix
glDrawArrays
gdiplus
GdipDeleteStringFormat
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromFile
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipDrawString
GdipMeasureString
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipLoadImageFromFile
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipFillEllipseI
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawImageRectI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdiplusShutdown
glu32
gluOrtho2D
kernel32
TlsSetValue
TlsGetValue
TlsAlloc
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
SetHandleCount
ExitProcess
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCPInfo
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
VirtualQuery
GetSystemInfo
GetProcAddress
VirtualAlloc
VirtualProtect
ExitThread
GetSystemTimeAsFileTime
GetLocalTime
DecodePointer
EncodePointer
InterlockedIncrement
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InitializeCriticalSectionAndSpinCount
RaiseException
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
CreateFileA
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WriteFile
GetModuleHandleW
LocalFree
FormatMessageW
SetLastError
FreeLibrary
LoadLibraryW
GetExitCodeThread
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
CopyFileW
UnmapViewOfFile
ReadFile
SetEndOfFile
SetFilePointer
FlushViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileAttributesW
GetFileSize
CreateFileW
Sleep
lstrlenA
GetEnvironmentVariableW
GetVersionExW
CloseHandle
CreateThread
OutputDebugStringW
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
GetModuleFileNameW
ReleaseMutex
SetStdHandle
CreateMutexW
GetLastError
lstrlenW
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
InterlockedDecrement
WriteConsoleW
OpenMutexW
user32
SetTimer
GetDC
ReleaseDC
PostQuitMessage
DefWindowProcW
InvalidateRect
UpdateWindow
BeginPaint
UpdateLayeredWindow
ShowWindow
GetSystemMetrics
SetLayeredWindowAttributes
KillTimer
SetWindowRgn
SetForegroundWindow
BringWindowToTop
SetFocus
RegisterClassExW
EndPaint
SetWindowPos
LoadIconW
DestroyIcon
SetWindowTextW
DispatchMessageW
TranslateMessage
GetMessageW
GetClientRect
SystemParametersInfoW
CreateWindowExW
DestroyWindow
GetWindowRect
MessageBoxW
LoadCursorW
SetCursor
LoadStringW
GetClassNameW
SendMessageW
PostMessageW
GetDesktopWindow
FindWindowExW
gdi32
GetObjectW
GetDIBColorTable
GetStockObject
SwapBuffers
ChoosePixelFormat
SetPixelFormat
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
CreateRectRgn
DeleteDC
SetDIBColorTable
StretchBlt
CreateCompatibleBitmap
shell32
ShellExecuteExW
ExtractIconW
ole32
CoInitialize
CoUninitialize
CoFreeUnusedLibraries
CoCreateInstance
oleaut32
SysAllocStringLen
SysFreeString
msimg32
TransparentBlt
AlphaBlend
Sections
.text Size: 483KB - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ