Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_058a788f53958a32f9f541b6f6ebeff6_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-28_058a788f53958a32f9f541b6f6ebeff6_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-28_058a788f53958a32f9f541b6f6ebeff6_mafia
-
Size
4.8MB
-
MD5
058a788f53958a32f9f541b6f6ebeff6
-
SHA1
77eb673246f86d81411b4d8812d3c81f70ff2675
-
SHA256
f87f0fb7ad72a3f2b58739a06a14127d3ed821420e913ba8a6ad7664447aeaf9
-
SHA512
f3cab4f68e5fc8271e12182ddb9635b396ffdfafe4b1a058939dca9d9250fa3472ccbc7d0ed91798da34d9f302f12aa92a097d4e3e5f2e95c130f6bc4848baf4
-
SSDEEP
98304:XiQL2xwKI8jXaOSgQXcmZD18l5V18w7kA3VKun462pMse0QSYMcU:zswf8jzKXwvr8w7NYumpzgnU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_058a788f53958a32f9f541b6f6ebeff6_mafia
Files
-
2024-01-28_058a788f53958a32f9f541b6f6ebeff6_mafia.exe windows:5 windows x86 arch:x86
12f68b61d15f9df27e090e37297bf0b8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryExW
DeleteFileW
GetCommandLineW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
LocalFree
GetTempPathW
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetProcessId
GetLastError
GetModuleFileNameW
GetUserDefaultLCID
GetLocalTime
GetLongPathNameW
LockResource
LoadResource
SizeofResource
FindResourceExW
GetDriveTypeW
MultiByteToWideChar
CreateThread
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetFileTime
SetFileAttributesW
CreateFileW
GetFileAttributesW
RemoveDirectoryW
GetCurrentThreadId
InitializeCriticalSection
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetFullPathNameW
CreateDirectoryW
FlushFileBuffers
GetFileSize
SetFilePointerEx
SetEndOfFile
ReadFile
GetShortPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
MoveFileW
SetVolumeLabelW
DeleteCriticalSection
WideCharToMultiByte
FormatMessageW
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
GetStringTypeW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetLocaleInfoW
GetThreadLocale
FormatMessageA
RtlUnwind
GetSystemTimeAsFileTime
HeapReAlloc
HeapFree
HeapAlloc
HeapSetInformation
GetStartupInfoW
GetCPInfo
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetStdHandle
GetTimeZoneInformation
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
LoadLibraryExA
GetModuleHandleExA
GetEnvironmentVariableA
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.debug_o Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 152KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ