C:\Work\ttol\head\mudfish\bin\muddiag\muddiag.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-11_68f47941028c21f6635ffbeb5baab816_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-11_68f47941028c21f6635ffbeb5baab816_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-11_68f47941028c21f6635ffbeb5baab816_mafia
-
Size
249KB
-
MD5
68f47941028c21f6635ffbeb5baab816
-
SHA1
18f68d7f8f4c318b40604952bd5e2cc11bd6bcaa
-
SHA256
071eb603e06b49e8e29582998f13a4dc3c57a2a0e276bc0166aea9abfc691eed
-
SHA512
6dea582801fd0d1c4e93e6973b8205255cf32c71d8b0639cba6dc82df6f969352c7e3dd39d77b61d1b27123ce562802b8a72ebe05bc22ac891face1547bf7ae9
-
SSDEEP
6144:9rHK+EoD26LQzs/gn99MOMYYMJF3NQnMIU:RHLEoD26Ed3MOMYzD3CMI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-11_68f47941028c21f6635ffbeb5baab816_mafia
Files
-
2024-02-11_68f47941028c21f6635ffbeb5baab816_mafia.exe windows:5 windows x86 arch:x86
a33908a2726820a03fedf6edbcf5497d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
FreeSid
dbghelp
SymFromAddr
SymInitialize
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
user32
MessageBoxA
winhttp
WinHttpCloseHandle
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpReadData
ws2_32
inet_addr
htonl
inet_ntoa
setsockopt
WSAStartup
sendto
recv
send
WSAGetLastError
WSASetLastError
ntohs
getnameinfo
getsockname
getpeername
closesocket
recvfrom
__WSAFDIsSet
select
socket
htons
connect
ioctlsocket
kernel32
SetEnvironmentVariableA
CreateFileW
CompareStringW
HeapSize
SetStdHandle
RaiseException
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
SetFilePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
FreeLibrary
GetExitCodeProcess
CreatePipe
GetFileAttributesA
RtlUnwind
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
InterlockedIncrement
TlsFree
IsProcessorFeaturePresent
HeapDestroy
HeapCreate
LoadLibraryW
SetConsoleCtrlHandler
FatalAppExitA
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
LocalFree
FormatMessageA
GetLastError
GetVersionExA
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetTempFileNameA
GetTempPathA
GetProcAddress
LoadLibraryA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
InitializeCriticalSection
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetThreadPriority
DuplicateHandle
GetCurrentThread
CreateEventA
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
ResetEvent
WaitForMultipleObjects
SystemTimeToFileTime
GetSystemTime
InterlockedCompareExchange
InterlockedExchange
SetEvent
ResumeThread
CreateProcessA
ReadFile
FlushFileBuffers
WriteFile
GetComputerNameA
RtlCaptureStackBackTrace
GetTickCount
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
HeapFree
HeapAlloc
DeleteFileA
ExitThread
CreateThread
HeapReAlloc
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ