Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_a9d41ddf9ee8adf9ea697c6cb88509ba_mafia.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-28_a9d41ddf9ee8adf9ea697c6cb88509ba_mafia.exe
Resource
win10v2004-20231222-en
General
-
Target
2024-01-28_a9d41ddf9ee8adf9ea697c6cb88509ba_mafia
-
Size
223KB
-
MD5
a9d41ddf9ee8adf9ea697c6cb88509ba
-
SHA1
971b6d7df562c5bab8b4a3164018c48e6f178f3d
-
SHA256
85d5da7b26454c4d2501f8252e4146c38ec44bf09089877b16a8be700798b19b
-
SHA512
72680285945a36da1293b223c665caaccd339ef3b475128e92c833f783c8eafe0b814ae06318e47ab7821063f73c5f6c770b350d975d7747c978333f9270ce4c
-
SSDEEP
3072:F5/F5McMoSMmXfSyFM+2YtAG7bxySz1dcBh615YQ8lJkqosSzHgXx8://FacMxMmPSy6TYOSxDdy6V8TkXzAh8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_a9d41ddf9ee8adf9ea697c6cb88509ba_mafia
Files
-
2024-01-28_a9d41ddf9ee8adf9ea697c6cb88509ba_mafia.exe windows:5 windows x86 arch:x86
e659fd300a7a120c2ce64a952712b2d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Module32Next
CloseHandle
QueryPerformanceCounter
GetTickCount
Thread32First
CreateProcessA
Thread32Next
FindFirstFileA
GetLastError
FindClose
OpenThread
FindNextFileA
GetCurrentThreadId
SuspendThread
ResumeThread
GetComputerNameA
GetCurrentProcess
Process32First
GetModuleHandleA
GetSystemWow64DirectoryA
OpenProcess
GetVolumeInformationA
VirtualFreeEx
ReadProcessMemory
GetSystemDirectoryA
GetProcAddress
VirtualAllocEx
Process32Next
GetExitCodeThread
GetModuleFileNameA
GetCurrentProcessId
GetTempPathA
WriteProcessMemory
GetThreadContext
SetThreadContext
VirtualAlloc
LoadLibraryExA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
Module32First
Sleep
CreateRemoteThread
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetProcessHeap
SetFilePointer
ReadFile
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetLocaleInfoW
SetHandleCount
GetFileType
GetStartupInfoW
user32
MessageBoxA
advapi32
GetTokenInformation
OpenProcessToken
GetUserNameA
shell32
ShellExecuteA
wininet
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
psapi
GetModuleFileNameExA
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ropf Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ