Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_2e5d5af6d689d9381853e4e9ebd4fefd_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-28_2e5d5af6d689d9381853e4e9ebd4fefd_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-28_2e5d5af6d689d9381853e4e9ebd4fefd_mafia
-
Size
4.8MB
-
MD5
2e5d5af6d689d9381853e4e9ebd4fefd
-
SHA1
d52995ceaea03f14687b9a5296e8e4abb14da7bb
-
SHA256
3484db5db54947506d04d69930765bc97c4b266d728f4eba4da500b8a15aa22a
-
SHA512
4e9174a225d70470b60162ca55dcdf29b7dca47b7c4adbf66aa439335104305c4cd3c67b77d3fc3683d5a6e839748f49aead6d31dfa5ae2315765ebde3762cc6
-
SSDEEP
98304:8CA9tGS3P0fIYFAXzbdcSFJi3b0SVPugYkDYm5xxee+VFdBf:uGuP0fIYFKzbdcSH+b0KuNJQYe+VFdBf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_2e5d5af6d689d9381853e4e9ebd4fefd_mafia
Files
-
2024-01-28_2e5d5af6d689d9381853e4e9ebd4fefd_mafia.exe windows:5 windows x86 arch:x86
beeb9967fa9c98967dbcbeb334a11b8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetCommandLineW
LoadLibraryExW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
LocalFree
GetTempPathW
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetProcessId
GetLastError
GetModuleFileNameW
GetUserDefaultLCID
GetLocalTime
GetFileAttributesW
GetLongPathNameW
LockResource
LoadResource
SizeofResource
FindResourceExW
GetDriveTypeW
MultiByteToWideChar
CreateThread
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetFileTime
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetCurrentThreadId
InitializeCriticalSection
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetFullPathNameW
CreateDirectoryW
GetCurrentProcess
FlushFileBuffers
GetFileSize
SetFilePointerEx
SetEndOfFile
ReadFile
GetShortPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
MoveFileW
SetVolumeLabelW
DeleteCriticalSection
WideCharToMultiByte
FormatMessageW
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
GetStringTypeW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetLocaleInfoW
GetThreadLocale
FormatMessageA
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSetInformation
GetStartupInfoW
GetCPInfo
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
HeapCreate
GetTimeZoneInformation
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_o Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.trace Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ