Static task
static1
Behavioral task
behavioral1
Sample
2024-01-26_6ef9eb531fd516f470c8ceae141e2ee3_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-26_6ef9eb531fd516f470c8ceae141e2ee3_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-26_6ef9eb531fd516f470c8ceae141e2ee3_mafia
-
Size
14.0MB
-
MD5
6ef9eb531fd516f470c8ceae141e2ee3
-
SHA1
52cdacceebe2d3eaeafd27147c1d9ba7b29393ed
-
SHA256
f37147d4bbcaf8b05f96820aaf8d148adb18336e3f01cbecb7b5f4b21e58c845
-
SHA512
8009f7e51fa9570a0ebbc2a1e1f996d2226c7d8ad6f3ac80ba4184a8f69344d3c0eee80e18951cf85f55a9da1d371c7d82f9048c6034972844e29312ce2a86b8
-
SSDEEP
393216:5wMYHSUFvsLSO3xbg5/tKjCV8jbbWXxicoUYo7wRTW8NCILTR/:OVaSO3O5/tqTwgCYo8RhEILl/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-26_6ef9eb531fd516f470c8ceae141e2ee3_mafia
Files
-
2024-01-26_6ef9eb531fd516f470c8ceae141e2ee3_mafia.exe windows:5 windows x86 arch:x86
57a10a57bbdc3abd564cff843299c136
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
HeapQueryInformation
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
HeapDestroy
QueryPerformanceCounter
IsDebuggerPresent
TerminateProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringW
GetStringTypeW
FatalAppExitA
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
SetCurrentDirectoryW
SetConsoleCtrlHandler
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLastError
GetVersionExW
CloseHandle
GetExitCodeProcess
WaitForSingleObjectEx
DeleteFileW
GetTempFileNameW
ExitProcess
CreateFileW
RemoveDirectoryW
SetUnhandledExceptionFilter
CreateThread
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetModuleFileNameW
GetFullPathNameW
LocalFree
FormatMessageW
FindClose
CreateDirectoryW
GetShortPathNameW
GetLocaleInfoW
FindFirstFileW
CopyFileW
FindNextFileW
GetFileAttributesW
SetFileAttributesW
FindResourceW
SizeofResource
LockResource
LoadResource
GetCommandLineW
GetModuleHandleW
FindResourceA
GlobalLock
GlobalAlloc
GetModuleFileNameA
FreeLibrary
LoadLibraryW
InterlockedDecrement
LocalAlloc
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
AttachConsole
VirtualQuery
GetSystemInfo
ReadFile
ExitThread
FindFirstFileExW
GetDriveTypeW
FindFirstFileExA
GetFileType
SetStdHandle
HeapReAlloc
GetCPInfo
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
LocalLock
LocalUnlock
FindResourceExW
GetDiskFreeSpaceW
ReplaceFileW
GetUserDefaultLCID
VirtualProtect
GetProfileIntW
SearchPathW
GetTempPathW
GetNumberFormatW
GetWindowsDirectoryW
GetTickCount
GetCurrentDirectoryW
GetFileSizeEx
LocalFileTimeToFileTime
GetFileAttributesExW
SetErrorMode
lstrcpyW
GetSystemDirectoryW
GlobalFlags
SystemTimeToFileTime
GetAtomNameW
GlobalGetAtomNameW
TlsFree
VirtualAlloc
GetTimeFormatA
GetDateFormatA
DeleteFileA
CreateDirectoryA
LocalReAlloc
GlobalHandle
FreeConsole
GetCurrentProcessId
GetProcAddress
GlobalReAlloc
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
LoadLibraryExW
ReleaseActCtx
CreateActCtxW
lstrcmpA
GetVolumeInformationW
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
MoveFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
InitializeCriticalSectionAndSpinCount
ActivateActCtx
DeactivateActCtx
lstrcmpW
FreeResource
RaiseException
SetLastError
GlobalSize
MulDiv
HeapAlloc
InterlockedExchange
GetModuleHandleA
lstrcmpiA
lstrcpynA
GetProcessHeap
HeapFree
FileTimeToSystemTime
GetFileTime
GetFileAttributesA
GetLocaleInfoA
GetDriveTypeA
SetVolumeLabelA
FindNextFileA
FindFirstFileA
GetFullPathNameA
GetVolumeInformationA
FileTimeToLocalFileTime
CreateFileA
SetFileAttributesA
SetFileTime
GetVersion
GlobalUnlock
GlobalFree
lstrcpyA
GetSystemDirectoryA
LoadLibraryA
TlsGetValue
GetCurrentProcess
GetCurrentThread
DuplicateHandle
TlsSetValue
InterlockedIncrement
TlsAlloc
Sleep
GetCurrentThreadId
InterlockedCompareExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetVersionExA
user32
SetCursorPos
DrawFrameControl
DrawEdge
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
DrawFocusRect
InvertRect
GetMenuDefaultItem
GetNextDlgGroupItem
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
DrawStateW
RegisterClipboardFormatW
EnumChildWindows
LockWindowUpdate
IsMenu
GetSystemMenu
MonitorFromPoint
UnpackDDElParam
ReuseDDElParam
GetMenuBarInfo
LoadImageW
DestroyIcon
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
SetClassLongW
SetParent
CreatePopupMenu
NotifyWinEvent
SetWindowRgn
CreateAcceleratorTableW
LoadAcceleratorsW
DestroyAcceleratorTable
GetAsyncKeyState
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
PostThreadMessageW
LoadMenuW
WaitMessage
WindowFromPoint
KillTimer
SetTimer
DeleteMenu
UnregisterClassW
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
DestroyMenu
GetMenuItemInfoW
InflateRect
GetDialogBaseUnits
RealChildWindowFromPoint
SetWindowContextHelpId
MapDialogRect
CharNextW
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
IntersectRect
IsRectEmpty
CopyAcceleratorTableW
GetSysColorBrush
ShowOwnedPopups
GetMessageW
TranslateMessage
SystemParametersInfoW
OffsetRect
MessageBeep
IsZoomed
PostQuitMessage
CharUpperW
EndPaint
UnionRect
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
FillRect
ScrollWindowEx
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
SetDlgItemTextW
SetDlgItemInt
GetDlgItemTextW
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
IsWindowVisible
ValidateRect
UpdateLayeredWindow
SetMenuDefaultItem
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
IsClipboardFormatAvailable
SendNotifyMessageW
InSendMessage
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
FrameRect
GetUpdateRect
CharUpperBuffW
CopyIcon
SubtractRect
UpdateWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
CreateMenu
GetDoubleClickTime
GetWindowRgn
DestroyCursor
GetDCEx
WindowFromDC
GetTabbedTextExtentW
BeginPaint
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
CopyRect
PtInRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetWindowLongW
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
EndDialog
RegisterWindowMessageW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
CharToOemA
OemToCharA
FindWindowW
GetParent
GetWindowThreadProcessId
GetWindow
PostMessageW
LoadIconW
EnableWindow
FlashWindow
GetClientRect
IsIconic
SendMessageW
DrawIcon
LoadCursorW
SetCursor
GetCursorPos
GetSystemMetrics
MessageBoxW
SetRect
gdi32
ExtTextOutW
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
CreateHatchBrush
CreateRectRgnIndirect
GetRgnBox
GetBkColor
GetTextColor
GetTextExtentPoint32W
GetTextMetricsW
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
CombineRgn
GetMapMode
PatBlt
DPtoLP
OffsetRgn
TextOutW
SetDIBColorTable
GetDIBits
RealizePalette
StretchBlt
SetPixel
CreateDIBSection
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
GetCharWidthW
CreateFontW
StretchDIBits
GetCurrentObject
CreatePolygonRgn
CreateEllipticRgn
Polyline
Ellipse
Polygon
Rectangle
EnumFontFamiliesExW
RoundRect
GetWindowOrgEx
LPtoDP
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetViewportOrgEx
ExtFloodFill
SetPaletteEntries
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
SetPixelV
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
PtVisible
RectVisible
StartDocW
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
SelectClipPath
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetColorAdjustment
SetArcDirection
SetLayout
GetLayout
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
GetObjectW
SetBkColor
SetTextColor
GetDeviceCaps
CreateRoundRectRgn
CreateDCW
CopyMetaFileW
msimg32
AlphaBlend
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
IsValidSid
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
IsValidAcl
GetSecurityDescriptorDacl
GetFileSecurityW
SetFileSecurityW
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
IsTextUnicode
RegSetValueW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSecurityDescriptorControl
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
shell32
DragQueryFileW
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHAddToRecentDocs
ShellExecuteW
ExtractIconW
SHAppBarMessage
ord680
DragFinish
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
comctl32
InitCommonControlsEx
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx
shlwapi
PathAppendW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindExtensionA
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
ole32
CoTreatAsClass
StringFromCLSID
CoTaskMemAlloc
ReleaseStgMedium
CreateBindCtx
ReadClassStg
ReadFmtUserTypeStg
OleCreateStaticFromData
OleDuplicateData
OleCreate
CoCreateGuid
CoDisconnectObject
StringFromGUID2
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromProgID
CoInitialize
CreateStreamOnHGlobal
OleRun
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
OleLockRunning
OleSetMenuDescriptor
StgCreateDocfile
CreateFileMoniker
StgOpenStorage
StgIsStorageFile
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
OleGetClipboard
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleSave
WriteClassStm
CreateDataAdviseHolder
CreateOleAdviseHolder
GetRunningObjectTable
CoGetMalloc
OleIsRunning
OleQueryLinkFromData
OleQueryCreateFromData
OleRegGetMiscStatus
OleRegEnumVerbs
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
PropVariantCopy
CreateGenericComposite
CreateItemMoniker
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
GetHGlobalFromILockBytes
OleLoad
WriteClassStg
OleCreateLinkFromData
OleCreateFromData
OleRegGetUserType
OleSaveToStream
oleaut32
VariantClear
OleCreateFontIndirect
VarBstrFromDate
VarDecFromStr
VarBstrFromDec
VarBstrFromCy
VarCyFromStr
SysReAllocStringLen
VarDateFromStr
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
RegisterTypeLi
LoadRegTypeLi
DispCallFunc
SysAllocStringLen
VariantChangeType
VariantCopy
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
GetErrorInfo
SetErrorInfo
LoadTypeLi
CreateErrorInfo
gdiplus
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
ws2_32
getsockname
bind
listen
WSAStartup
socket
ioctlsocket
connect
__WSAFDIsSet
getsockopt
recv
send
select
closesocket
WSACleanup
WSASetLastError
ntohs
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
imm32
ImmGetOpenStatus
ImmReleaseContext
ImmGetContext
winmm
PlaySoundW
Sections
.text Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 899KB - Virtual size: 898KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ