C:\fibre\Output\BilbyTest.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-19_996320e0b56d2caa59cdcc927efb52ac_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-02-19_996320e0b56d2caa59cdcc927efb52ac_mafia.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-19_996320e0b56d2caa59cdcc927efb52ac_mafia
-
Size
729KB
-
MD5
996320e0b56d2caa59cdcc927efb52ac
-
SHA1
b4d28fab62767eb8195015b25a1e6b39c4b5a7fd
-
SHA256
2c6184f2a34d730cd55567f0038b4b42afb4accb9406475158443b6af36a88d6
-
SHA512
7041a9860f36ba94d781a155300d2ff9f4b770bd406783097c01df60e031ef0faff75bf3a6ad7d8eec3d97d45fb9fe7e3e8a29e01d1bc7d81b2ab81ca2bd7763
-
SSDEEP
12288:UGtEdcC4fPY+J20O0zVi98wTO3J7IedE/sAacxN/7/PrrkSMv:UGtEdcC4V2S3JseysHc3/LE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-19_996320e0b56d2caa59cdcc927efb52ac_mafia
Files
-
2024-02-19_996320e0b56d2caa59cdcc927efb52ac_mafia.exe windows:5 windows x86 arch:x86
9c5a9fdf2395a3aa33a9f3101a8de0f6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
gethostname
gethostbyname
inet_addr
connect
setsockopt
send
recv
closesocket
socket
WSACleanup
WSAStartup
htonl
htons
WSAGetLastError
kernel32
HeapReAlloc
CreateFileA
SetEnvironmentVariableA
IsValidCodePage
GetOEMCP
GetACP
Sleep
WaitForSingleObject
CloseHandle
GetLastError
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
GetCurrentThreadId
GetUserDefaultLCID
TlsFree
TlsGetValue
TlsSetValue
CreateEventW
SetEvent
ResetEvent
WriteFile
WriteConsoleW
GetConsoleMode
GetFileType
GetStdHandle
AllocConsole
OutputDebugStringW
GetCurrentProcessId
HeapFree
GetProcessHeap
HeapAlloc
GetCurrentProcess
InterlockedCompareExchange
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
CreateProcessA
SetStdHandle
TlsAlloc
FlushFileBuffers
ReadFile
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
SetEndOfFile
CreateFileW
FindClose
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFullPathNameW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CompareStringW
CreateDirectoryW
SetLastError
GetProcAddress
GetModuleHandleA
AreFileApisANSI
LocalFree
FormatMessageA
RaiseException
RtlUnwind
GetCommandLineA
HeapSetInformation
ExitThread
ResumeThread
CreateThread
GetCPInfo
GetTimeFormatW
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
MoveFileW
LCMapStringW
IsProcessorFeaturePresent
GetModuleFileNameW
GetLocaleInfoW
HeapCreate
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetFileAttributesA
GetConsoleCP
SetFilePointer
advapi32
RegisterEventSourceW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
DeregisterEventSource
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
ReportEventW
shell32
ShellExecuteExW
Sections
.text Size: 536KB - Virtual size: 535KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 51KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ