C:\NewRT\Ffactor\Release\Eng_FormFactor.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-13_1b77c5d7c5e54e92a85bf3691f8fc8fc_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-02-13_1b77c5d7c5e54e92a85bf3691f8fc8fc_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-13_1b77c5d7c5e54e92a85bf3691f8fc8fc_mafia
-
Size
846KB
-
MD5
1b77c5d7c5e54e92a85bf3691f8fc8fc
-
SHA1
6621ace28cd40842f3f72f4bb3495a9656c2cc69
-
SHA256
7ec53590a09d1e2171da966445e2d1b10ecfae51b433c78b25b6766fd0bf5a67
-
SHA512
46a12a5ed694dfc8130070343440c47e18d220b4f8828fe67cdd6d954ecff81e8624612ac00881dc999730c8ce2f5688f5f545fea06f7b456075899235235d07
-
SSDEEP
12288:9XaZGhmcGujg+22z6dwBbiwlfLpRlhh94i8qEazHmCkc3BXSxMiGVdhJ:QQgCea5lfLpRllUq3zHmCBUGVXJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-13_1b77c5d7c5e54e92a85bf3691f8fc8fc_mafia
Files
-
2024-02-13_1b77c5d7c5e54e92a85bf3691f8fc8fc_mafia.exe windows:5 windows x86 arch:x86
e8c428a2ddd7483e623ac8477f90f785
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateFileMappingA
MapViewOfFile
RtlMoveMemory
UnmapViewOfFile
CloseHandle
GetProcessHeap
CreateFileW
IsValidLocale
EnumSystemLocalesA
InterlockedExchange
IsDebuggerPresent
SetLastError
SetConsoleCtrlHandler
GetACP
GetCommandLineA
SetErrorMode
GetModuleHandleA
GetProcAddress
Sleep
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
WaitForSingleObject
VirtualAlloc
VirtualFree
SetFilePointer
GetLastError
GetFileType
WriteFile
EnterCriticalSection
LeaveCriticalSection
GetFileAttributesExA
GetFileSize
GetFileAttributesA
SetEndOfFile
GetThreadLocale
LoadLibraryA
GetStdHandle
FormatMessageA
FreeLibrary
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
SetEvent
ReleaseMutex
CreateEventA
ExitThread
TerminateThread
CreateThread
CreateMutexA
OpenFileMappingA
IsBadReadPtr
GetHandleInformation
GetFileInformationByHandle
GetFullPathNameA
GetTempFileNameA
GetTempPathA
ReadFile
CreateProcessA
SetThreadPriority
GetVersionExA
DeleteFileA
FlushFileBuffers
HeapSetInformation
DecodePointer
EncodePointer
ResumeThread
HeapAlloc
HeapReAlloc
HeapFree
GetModuleHandleW
ExitProcess
GetCurrentProcessId
SetStdHandle
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetUnhandledExceptionFilter
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
FatalAppExitA
HeapSize
HeapQueryInformation
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
MultiByteToWideChar
LoadLibraryW
GetLocaleInfoW
RtlUnwind
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
VirtualQuery
imagehlp
SymCleanup
SymInitialize
StackWalk64
Sections
.text Size: 643KB - Virtual size: 643KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text1 Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 32.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.trace Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ