Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_6fb65e87f26c1b42e3f7ee9725dbf9e2_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_6fb65e87f26c1b42e3f7ee9725dbf9e2_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_6fb65e87f26c1b42e3f7ee9725dbf9e2_mafia
-
Size
4.8MB
-
MD5
6fb65e87f26c1b42e3f7ee9725dbf9e2
-
SHA1
fd6b12be09c9c4f1eda490ba59e1cbc078115ba0
-
SHA256
a3c34dc979ee5f5d0d9d6f7d06395860ee43196ce0fb5eb98af5c6c49feb0266
-
SHA512
e7259c41337644c2d48b7f08daa04802e7379a0478964237f8e4b5bdcdfd7839833510518a72f9350ec6e8507eadedb37f1f42158dd890e88c0a7c986b850f65
-
SSDEEP
98304:8CA9tGS3P0fIYFAXzbdcSFJi3b0SVPugYkDYm5xxee+VFdBK:uGuP0fIYFKzbdcSH+b0KuNJQYe+VFdBK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_6fb65e87f26c1b42e3f7ee9725dbf9e2_mafia
Files
-
2024-01-28_6fb65e87f26c1b42e3f7ee9725dbf9e2_mafia.exe windows:5 windows x86 arch:x86
beeb9967fa9c98967dbcbeb334a11b8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetCommandLineW
LoadLibraryExW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
LocalFree
GetTempPathW
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetProcessId
GetLastError
GetModuleFileNameW
GetUserDefaultLCID
GetLocalTime
GetFileAttributesW
GetLongPathNameW
LockResource
LoadResource
SizeofResource
FindResourceExW
GetDriveTypeW
MultiByteToWideChar
CreateThread
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetFileTime
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetCurrentThreadId
InitializeCriticalSection
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetFullPathNameW
CreateDirectoryW
GetCurrentProcess
FlushFileBuffers
GetFileSize
SetFilePointerEx
SetEndOfFile
ReadFile
GetShortPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
MoveFileW
SetVolumeLabelW
DeleteCriticalSection
WideCharToMultiByte
FormatMessageW
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
GetStringTypeW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetLocaleInfoW
GetThreadLocale
FormatMessageA
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSetInformation
GetStartupInfoW
GetCPInfo
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
HeapCreate
GetTimeZoneInformation
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_o Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.trace Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ