Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_626b92e2b28941828fd1cb60f5959eb5_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-25_626b92e2b28941828fd1cb60f5959eb5_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-25_626b92e2b28941828fd1cb60f5959eb5_mafia
-
Size
274KB
-
MD5
626b92e2b28941828fd1cb60f5959eb5
-
SHA1
8b39f757f616c7691e047279733ae8f9f0747214
-
SHA256
b2a6506314fcd5039a4f2ee3b0f41cfcf3aa06a314ce82076464309f59cd5dc5
-
SHA512
959639ea3ecd096c16cb501897efeb28e020fa3876ae0e179c36ad67b1c4609af4d67946864c659ba89ec978b2053e5c61bd764332acac2947fc9a6dc445bf65
-
SSDEEP
6144:WPExVflN6s004Q+EUgNyPZZC1mudis6m2Xc:WufSGn+EUgNSzKWm2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-25_626b92e2b28941828fd1cb60f5959eb5_mafia
Files
-
2024-01-25_626b92e2b28941828fd1cb60f5959eb5_mafia.exe windows:5 windows x86 arch:x86
e8488c141dff1bdd0908cf1aff27ecb0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
CoTaskMemFree
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
kernel32
CloseHandle
WaitForSingleObject
ReleaseMutex
GetLastError
SetLastError
CreateProcessW
GetModuleFileNameW
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
RaiseException
GetCurrentThreadId
Sleep
IsDebuggerPresent
GetUserDefaultLangID
ExpandEnvironmentStringsW
InterlockedCompareExchange
LocalFree
GetCommandLineW
GetCurrentProcess
HeapSetInformation
GetProcAddress
GetModuleHandleW
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetNativeSystemInfo
GetVersionExW
InterlockedExchangeAdd
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
InterlockedIncrement
InterlockedExchange
WideCharToMultiByte
InterlockedDecrement
MultiByteToWideChar
InitializeCriticalSection
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
GetConsoleCP
ExitProcess
HeapReAlloc
HeapAlloc
GetCPInfo
RtlUnwind
LCMapStringW
HeapCreate
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetTimeZoneInformation
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
GetStringTypeW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
GetFileAttributesW
LoadLibraryA
LocalAlloc
GetCurrentProcessId
GetTempPathW
GetCurrentDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFullPathNameW
GetDriveTypeW
GetConsoleMode
user32
MessageBoxW
advapi32
CreateProcessAsUserW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ