Static task
static1
Behavioral task
behavioral1
Sample
2024-01-18_6494fa786fc8f015718f970ef69f5125_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-18_6494fa786fc8f015718f970ef69f5125_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-18_6494fa786fc8f015718f970ef69f5125_mafia
-
Size
378KB
-
MD5
6494fa786fc8f015718f970ef69f5125
-
SHA1
082890c44b3a0ef34e5edcb4ef6dad1a582abb75
-
SHA256
45dda6777c59b135ae7635f9858187b0e61fb08d99254c13aae703e675214f46
-
SHA512
d7b662c5868289a85205f21f4a632938d99ac67ab1cce50d2058195002bc9887a458e0fbf744b6e328da9ee9cc20036458d8ec30bcfe3fbda458751a00e5a3bb
-
SSDEEP
6144:/nwrRuy2j0WLfEMw0wOf3Xw+31hYmvAgjhPUOFQR1vZGZnoOvuERvpKN:/nwrgy2QWLsMw0hwO1OCAgF7i14oWunN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-18_6494fa786fc8f015718f970ef69f5125_mafia
Files
-
2024-01-18_6494fa786fc8f015718f970ef69f5125_mafia.exe windows:5 windows x86 arch:x86
5667553d4289213958520f2d03ad7f40
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Module32NextW
Module32FirstW
LocalFree
FindClose
GetLastError
GetFileAttributesW
CreateFileW
GetFileInformationByHandle
SetFileAttributesW
WideCharToMultiByte
GetTempPathW
GetCurrentDirectoryW
GetTempFileNameW
DeleteFileW
RemoveDirectoryW
CopyFileW
MoveFileW
FindFirstFileW
FindNextFileW
WriteFile
ReadFile
SetFilePointer
CreateDirectoryW
GetDriveTypeW
GetWindowsDirectoryW
GetNativeSystemInfo
GetComputerNameW
GetModuleHandleW
GetModuleFileNameW
GetCurrentProcess
ExpandEnvironmentStringsW
GetProcAddress
FormatMessageW
InterlockedIncrement
InterlockedDecrement
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
LoadLibraryW
FreeLibrary
GetFileSize
InitializeCriticalSection
OpenMutexW
SetErrorMode
GetCurrentProcessId
GlobalMemoryStatusEx
FlushFileBuffers
DeviceIoControl
GetTickCount
SetEndOfFile
TerminateProcess
SetCurrentDirectoryW
GetCurrentThread
VirtualQuery
ReadProcessMemory
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
HeapFree
HeapSetInformation
GetStartupInfoW
GetFullPathNameW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetACP
GetOEMCP
IsValidCodePage
HeapSize
HeapReAlloc
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringW
CloseHandle
MoveFileExW
WaitForSingleObject
CreateMutexW
GetCommandLineW
Sleep
ReleaseMutex
GetPrivateProfileIntW
LoadLibraryA
GetCurrentThreadId
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
RegQueryValueExW
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
Sections
.text Size: 251KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ