Static task
static1
Behavioral task
behavioral1
Sample
2024-01-11_e737b7bf189a1c3d363e686be8bd30e3_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-11_e737b7bf189a1c3d363e686be8bd30e3_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-11_e737b7bf189a1c3d363e686be8bd30e3_mafia
-
Size
1.4MB
-
MD5
e737b7bf189a1c3d363e686be8bd30e3
-
SHA1
9268b87150e1250fc01e9a6eaf02ad8db8aa31e8
-
SHA256
93347c00ac434abb280b0beb3b03e3cd3c841079adddcca1abc56f8aabe94cc4
-
SHA512
8280d0df3efaee57991a3a83292a46f41f15bb73cbcf1c93b19159f3aa61e97d931135313ca8577e3489170964d6b37824980b8fce1fbd550cc459eb2329be4e
-
SSDEEP
24576:ppWWlMAKCC2V2bxk1x03QJxtbyVteKud2TZvIMUwD:jjHKCCjbiPtJxtbyVtv82TRHU6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-11_e737b7bf189a1c3d363e686be8bd30e3_mafia
Files
-
2024-01-11_e737b7bf189a1c3d363e686be8bd30e3_mafia.exe windows:5 windows x86 arch:x86
313b8732f43a742474fdb5f68c05f58f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
awesomium
??1Load@WebViewListener@Awesomium@@MAE@XZ
??1Process@WebViewListener@Awesomium@@MAE@XZ
??1Menu@WebViewListener@Awesomium@@MAE@XZ
??0WebString@Awesomium@@QAE@XZ
??8WebString@Awesomium@@QBE_NABV01@@Z
??1View@WebViewListener@Awesomium@@MAE@XZ
??1JSValue@Awesomium@@QAE@XZ
??4JSValue@Awesomium@@QAEAAV01@ABV01@@Z
?Undefined@JSValue@Awesomium@@SAABV12@XZ
?IsBoolean@JSValue@Awesomium@@QBE_NXZ
?IsInteger@JSValue@Awesomium@@QBE_NXZ
?IsDouble@JSValue@Awesomium@@QBE_NXZ
?IsString@JSValue@Awesomium@@QBE_NXZ
?IsArray@JSValue@Awesomium@@QBE_NXZ
?IsObject@JSValue@Awesomium@@QBE_NXZ
?IsNull@JSValue@Awesomium@@QBE_NXZ
?IsUndefined@JSValue@Awesomium@@QBE_NXZ
?ToString@JSValue@Awesomium@@QBE?AVWebString@2@XZ
?ToInteger@JSValue@Awesomium@@QBEHXZ
?ToDouble@JSValue@Awesomium@@QBENXZ
?ToBoolean@JSValue@Awesomium@@QBE_NXZ
?ToObject@JSValue@Awesomium@@QAEAAVJSObject@2@XZ
??0JSObject@Awesomium@@QAE@XZ
??1JSObject@Awesomium@@QAE@XZ
??4JSObject@Awesomium@@QAEAAV01@ABV01@@Z
?SetCustomMethod@JSObject@Awesomium@@QAEXABVWebString@2@_N@Z
?GetKeyIdentifierFromVirtualKeyCode@Awesomium@@YAXHPAPAD@Z
?CopyTo@BitmapSurface@Awesomium@@QBEXPAEHH_N1@Z
?SaveToPNG@BitmapSurface@Awesomium@@QBE_NABVWebString@2@_N@Z
??0WebKeyboardEvent@Awesomium@@QAE@XZ
?size@JSArray@Awesomium@@QBEIXZ
??AJSArray@Awesomium@@QBEABVJSValue@1@I@Z
?size@WebMenuItemArray@Awesomium@@QBEIXZ
?At@WebMenuItemArray@Awesomium@@QBEABUWebMenuItem@2@I@Z
??_7Load@WebViewListener@Awesomium@@6B@
??_7Menu@WebViewListener@Awesomium@@6B@
??_7View@WebViewListener@Awesomium@@6B@
??_7Process@WebViewListener@Awesomium@@6B@
?OnFilterNavigation@ResourceInterceptor@Awesomium@@UAE_NHHABVWebString@2@ABVWebURL@2@_N@Z
?OnWillDownload@ResourceInterceptor@Awesomium@@UAEXHHABVWebURL@2@@Z
??1WebConfig@Awesomium@@QAE@XZ
??1WebPreferences@Awesomium@@QAE@XZ
?Initialize@WebCore@Awesomium@@SAPAV12@ABUWebConfig@2@@Z
?Shutdown@WebCore@Awesomium@@SAXXZ
?instance@WebCore@Awesomium@@SAPAV12@XZ
??1WebString@Awesomium@@QAE@XZ
??4WebString@Awesomium@@QAEAAV01@ABV01@@Z
?CreateFromUTF8@WebString@Awesomium@@SA?AV12@PBDI@Z
?length@WebString@Awesomium@@QBEIXZ
?ToUTF8@WebString@Awesomium@@QBEIPADI@Z
??0WebConfig@Awesomium@@QAE@XZ
??0WebURL@Awesomium@@QAE@ABVWebString@1@@Z
??1WebURL@Awesomium@@QAE@XZ
?spec@WebURL@Awesomium@@QBE?AVWebString@2@XZ
??0WebPreferences@Awesomium@@QAE@XZ
??_7ResourceInterceptor@Awesomium@@6B@
?IsNumber@JSValue@Awesomium@@QBE_NXZ
??0JSValue@Awesomium@@QAE@ABV01@@Z
shell32
SHGetFolderPathA
winmm
timeGetTime
timeBeginPeriod
psapi
GetPerformanceInfo
GetProcessMemoryInfo
wsock32
bind
inet_addr
ntohs
ioctlsocket
recvfrom
sendto
accept
recv
send
inet_ntoa
shutdown
closesocket
connect
WSAGetLastError
listen
gethostbyname
WSACleanup
WSAStartup
socket
setsockopt
htonl
htons
gethostname
select
getsockopt
__WSAFDIsSet
getsockname
ws2_32
GetAddrInfoW
FreeAddrInfoW
kernel32
VirtualAlloc
CompareStringW
WriteConsoleW
GetProcessHeap
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDriveTypeW
SetEnvironmentVariableA
SetFilePointer
FlushFileBuffers
GetConsoleCP
VirtualQuery
GetTimeZoneInformation
PeekNamedPipe
GetFullPathNameA
HeapCreate
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetLastError
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
GetModuleHandleW
HeapSize
IsProcessorFeaturePresent
GetLocaleInfoW
GetStdHandle
GetCPInfo
LCMapStringW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
ExitThread
HeapReAlloc
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
GetDateFormatA
GetTimeFormatA
HeapFree
DeleteFileA
FindFirstFileExA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetStringTypeW
DecodePointer
EncodePointer
MultiByteToWideChar
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
CreateFileMappingA
LocalFree
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
InterlockedCompareExchange
FormatMessageA
SetThreadPriority
DeleteFileW
CreateFileW
GetFileInformationByHandle
SetFilePointerEx
GetFileSizeEx
GetSystemTimes
GetProcessTimes
CreateMutexW
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
GetTickCount
SystemTimeToFileTime
CreateDirectoryW
GetDiskFreeSpaceExW
GetFullPathNameW
SetConsoleTitleW
GetVersionExW
GetCommandLineW
GetModuleFileNameW
GetConsoleTitleW
GetComputerNameW
GetCurrentProcessId
Sleep
GetLastError
CreateFileA
CloseHandle
WriteFile
GetModuleFileNameA
OutputDebugStringA
GetConsoleWindow
CreateDirectoryA
RemoveDirectoryA
MoveFileA
FreeLibrary
GetProcessId
GetProcAddress
LoadLibraryA
GetCurrentProcess
WaitForSingleObjectEx
RaiseException
WaitForSingleObject
SetEvent
VirtualFree
TerminateProcess
GetExitCodeProcess
CreateProcessA
ReleaseMutex
VirtualProtect
QueueUserAPC
ResetEvent
GetCurrentThreadId
LocalAlloc
SetUnhandledExceptionFilter
CreateMutexA
CreateEventA
CreateThread
ReadFile
FindClose
FindNextFileA
FindFirstFileA
GetTempPathA
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
ResumeThread
FlushInstructionCache
GetThreadContext
SuspendThread
OpenThread
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsAlloc
TlsSetValue
DuplicateHandle
GetCurrentThread
TlsGetValue
TlsFree
FormatMessageW
LoadLibraryW
SetDllDirectoryW
Sections
.text Size: 1016KB - Virtual size: 1016KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 157KB - Virtual size: 214KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ