Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_f3d3a460cb7d60852f11d2612833b555_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_f3d3a460cb7d60852f11d2612833b555_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_f3d3a460cb7d60852f11d2612833b555_mafia
-
Size
4.8MB
-
MD5
f3d3a460cb7d60852f11d2612833b555
-
SHA1
8313c9d404cb4869e0ce3022680d4717e108ef1c
-
SHA256
fbd5d6811eb6d85c5bb33560853e70deeb59c77d6465462a93defdd19173b9a7
-
SHA512
1508d1fde2efdd7043c3f30f6889ac01404fbd473cd0187f4448006ac264ed35682b678a4ca6e1cec388a1855b312f324aaa2e8a23671b583e378e1f4aa1bf75
-
SSDEEP
98304:8CA9tGS3P0fIYFAXzbdcSFJi3b0SVPugYkDYm5xxee+VFdBt:uGuP0fIYFKzbdcSH+b0KuNJQYe+VFdBt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_f3d3a460cb7d60852f11d2612833b555_mafia
Files
-
2024-01-28_f3d3a460cb7d60852f11d2612833b555_mafia.exe windows:5 windows x86 arch:x86
beeb9967fa9c98967dbcbeb334a11b8a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetCommandLineW
LoadLibraryExW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleW
LocalFree
GetTempPathW
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
GetProcessId
GetLastError
GetModuleFileNameW
GetUserDefaultLCID
GetLocalTime
GetFileAttributesW
GetLongPathNameW
LockResource
LoadResource
SizeofResource
FindResourceExW
GetDriveTypeW
MultiByteToWideChar
CreateThread
LeaveCriticalSection
EnterCriticalSection
WriteFile
SetFileTime
SetFileAttributesW
CreateFileW
RemoveDirectoryW
GetCurrentThreadId
InitializeCriticalSection
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetFullPathNameW
CreateDirectoryW
GetCurrentProcess
FlushFileBuffers
GetFileSize
SetFilePointerEx
SetEndOfFile
ReadFile
GetShortPathNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
MoveFileW
SetVolumeLabelW
DeleteCriticalSection
WideCharToMultiByte
FormatMessageW
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
GetStringTypeW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
GetLocaleInfoW
GetThreadLocale
FormatMessageA
RtlUnwind
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSetInformation
GetStartupInfoW
GetCPInfo
LCMapStringW
GetTimeFormatA
GetDateFormatA
CompareStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
HeapCreate
GetTimeZoneInformation
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryW
SetStdHandle
WriteConsoleW
SetEnvironmentVariableA
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.debug_o Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.trace Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ