Static task
static1
Behavioral task
behavioral1
Sample
2024-01-23_dc7639c8a69edd26c007a1644e4f4744_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-23_dc7639c8a69edd26c007a1644e4f4744_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-23_dc7639c8a69edd26c007a1644e4f4744_mafia
-
Size
3.5MB
-
MD5
dc7639c8a69edd26c007a1644e4f4744
-
SHA1
5a0307b91a3ed63d9dc5d7d88eb258697bd7bfcc
-
SHA256
7f2ee3c672f6d99fb2f800c8c89334ceb2e42eeeb0fc5e34b2a76ebb0b924009
-
SHA512
6e8b0be5845a2902e730eaff0a67e302515b96279ff1abee4dcefa3322441fcdf5fe78dbddffd290025ab3132d792133712eb446e23d8187edc4658a52938444
-
SSDEEP
49152:PyP7N29zHySOfKPgsFCl2oSWpLTXSfUpEgp:aBAzGfYgsFc2oSWpCfw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-23_dc7639c8a69edd26c007a1644e4f4744_mafia
Files
-
2024-01-23_dc7639c8a69edd26c007a1644e4f4744_mafia.exe windows:5 windows x86 arch:x86
e513fa7191a88e86f6e74582f01d53e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
CloseHandle
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SystemTimeToFileTime
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetTickCount
OpenMutexW
CreateMutexW
SetUnhandledExceptionFilter
FileTimeToSystemTime
SetEndOfFile
WriteConsoleW
CreateFileW
FlushFileBuffers
SetStdHandle
IsValidLocale
LeaveCriticalSection
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
DeleteCriticalSection
HeapCreate
ExitProcess
HeapSize
SetLastError
GetModuleHandleW
TlsFree
EnumSystemLocalesA
EnterCriticalSection
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
ReadFile
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
CompareStringW
GetCPInfo
LCMapStringW
HeapAlloc
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineW
CreateThread
ExitThread
HeapReAlloc
GetProcessHeap
HeapFree
LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetSystemTimeAsFileTime
GetLocalTime
WriteFile
Sleep
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
user32
GetAsyncKeyState
GetClientRect
ClientToScreen
OffsetRect
SetCursorPos
GetCursorPos
MessageBoxA
PostQuitMessage
LoadStringW
PeekMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
GetSystemMetrics
CreateWindowExW
ShowWindow
UpdateWindow
DefWindowProcW
SetWindowTextW
SetWindowPos
wsprintfW
GetKeyState
FlashWindow
MessageBoxW
ShowCursor
shell32
ShellExecuteW
iphlpapi
GetAdaptersInfo
ws2_32
WSAStartup
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
recv
inet_ntoa
send
WSAGetLastError
WSASetEvent
shutdown
closesocket
socket
gethostbyname
inet_addr
htons
connect
dbghelp
MiniDumpWriteDump
d3d9
Direct3DCreate9
d3dx9_42
D3DXCompileShader
D3DXCreateLine
D3DXCreateTextureFromFileExW
D3DXMatrixAffineTransformation2D
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateSprite
bass
BASS_ChannelStop
BASS_ChannelPlay
BASS_ChannelSetAttribute
BASS_StreamCreateFile
BASS_Init
BASS_GetVersion
BASS_StreamFree
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ