Static task
static1
Behavioral task
behavioral1
Sample
2024-01-28_647b7d748974eb0647cb2172136f3b4a_mafia_nionspy.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-01-28_647b7d748974eb0647cb2172136f3b4a_mafia_nionspy.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-28_647b7d748974eb0647cb2172136f3b4a_mafia_nionspy
-
Size
327KB
-
MD5
647b7d748974eb0647cb2172136f3b4a
-
SHA1
929fd3e621bce7981da5384a0e913ee79b6c816f
-
SHA256
a8b9655bed25ba872db425687063be616aaa1a833b695654d6506b7d022cb9c7
-
SHA512
ef271075f1179057494add938865e17c0eb7f120e79da9f588b6998100f0f5898b0262069b169cda1b9543bbc0dc76ad54c3b408b65e1a6703376e16a422366b
-
SSDEEP
6144:n2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:n2TFafJiHCWBWPMjVWrXK0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-01-28_647b7d748974eb0647cb2172136f3b4a_mafia_nionspy
Files
-
2024-01-28_647b7d748974eb0647cb2172136f3b4a_mafia_nionspy.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 222KB - Virtual size: 221KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ