Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_3c9f5602ede421890a282bf5d52bc327_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-11_3c9f5602ede421890a282bf5d52bc327_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-11_3c9f5602ede421890a282bf5d52bc327_mafia
-
Size
859KB
-
MD5
3c9f5602ede421890a282bf5d52bc327
-
SHA1
9f4418e84ca07b82ac274e7cedaa9f21c4590d7d
-
SHA256
353fa930be117fc36b29fe0e8270a4185384a5a99db6d4690e84c92003cef6c0
-
SHA512
e74b4ff6b46d020b6c44b0fb74b92980991b8da369b96a34f5331748898dbc7921e14af25094eb7ea6ec37e5edb98688621296737da855316cc259c12baf0ca3
-
SSDEEP
24576:8lPtoZdMXRgZx87tWVkWi/C9ceoGpwYgnbxi:QtoZdMXRgZAmgC96WwYgNi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-11_3c9f5602ede421890a282bf5d52bc327_mafia
Files
-
2024-01-11_3c9f5602ede421890a282bf5d52bc327_mafia.exe windows:5 windows x86 arch:x86
ab2e5b1ca936f68cf988ac4db88418ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
WSAIoctl
recvfrom
inet_ntoa
htons
socket
bind
closesocket
getsockname
inet_addr
ioctlsocket
getsockopt
setsockopt
sendto
gethostname
gethostbyname
ntohs
htonl
kernel32
FindFirstFileExA
CompareStringW
CreateFileW
GetProcessHeap
SetEndOfFile
CreateFileA
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
InterlockedExchange
LoadLibraryW
FatalAppExitA
FindFirstFileA
FindClose
FindNextFileA
DeleteFileA
CreateDirectoryA
GetFileAttributesA
MoveFileA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
Sleep
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
SetThreadPriority
CreateEventA
SetEvent
WaitForSingleObjectEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
FormatMessageA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
SetConsoleCtrlHandler
GetTickCount
HeapFree
RtlUnwind
RaiseException
HeapAlloc
DecodePointer
EncodePointer
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEnvironmentVariableA
GetTimeZoneInformation
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
LCMapStringW
HeapCreate
HeapDestroy
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
WriteFile
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
SetFilePointer
GetLocaleInfoW
HeapSize
GetConsoleCP
GetConsoleMode
Sections
.text Size: 705KB - Virtual size: 705KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ