E:\BuildEngineSpace\Temp\08974ff8-adc9-43e0-a5f1-10fd4667e70b\build\Win32\Release\McItInfo.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-21_0b7e29a1def06733a288343dbc07c1ef_mafia_virut.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-21_0b7e29a1def06733a288343dbc07c1ef_mafia_virut.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-21_0b7e29a1def06733a288343dbc07c1ef_mafia_virut
-
Size
25.4MB
-
MD5
0b7e29a1def06733a288343dbc07c1ef
-
SHA1
c2cb9bfb909ce96ee8ecc246791e5431bf785fc3
-
SHA256
fb7a86dd31218f867db1a1b71d36599b3a580bb0ae1b83251e5ffba67317b218
-
SHA512
5992a84a79cfee97c96d6800300fb3db62f7ad4309989817207dde8027906a3cae374a1fffa6db1e966a92b3b71d69d42aa835bb4a6336961d9d8403029287dd
-
SSDEEP
12288:1NtjmPzAb0TGFzWZSsHGuuIQYf+PFHEz/FGAq+N8rYkuh6LFV575F3k/RuoHu5F:1NtgGFzWZSsRuIQYf+PFkje366v9r2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-21_0b7e29a1def06733a288343dbc07c1ef_mafia_virut
Files
-
2024-02-21_0b7e29a1def06733a288343dbc07c1ef_mafia_virut.exe windows:5 windows x86 arch:x86
a852808dc37f58b1fa59b725ada63b7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
wininet
InternetQueryOptionA
DetectAutoProxyUrl
InternetSetCookieW
InternetGetCookieW
HttpOpenRequestW
HttpQueryInfoW
HttpAddRequestHeadersW
HttpSendRequestW
InternetOpenW
InternetSetOptionW
InternetConnectW
InternetCrackUrlW
InternetCloseHandle
InternetReadFile
kernel32
GetLocaleInfoA
GetThreadLocale
FindClose
FindFirstFileW
SetEvent
CreateEventW
CreateMutexW
GetLocalTime
CloseHandle
GetLocaleInfoW
InterlockedIncrement
InterlockedDecrement
IsBadReadPtr
FindNextFileW
GetModuleFileNameW
GlobalFree
GlobalAlloc
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
GetShortPathNameW
GetTempPathW
DeleteFileW
MoveFileExW
Sleep
RaiseException
FlushInstructionCache
OutputDebugStringW
SetFileAttributesW
GetFileAttributesW
IsBadStringPtrW
GetCurrentThreadId
GlobalUnlock
GlobalLock
CopyFileW
FlushFileBuffers
WriteFile
CreateFileW
GetTempFileNameW
ReadFile
GetACP
SetLastError
IsBadWritePtr
lstrlenW
lstrlenA
GetComputerNameW
OpenProcess
OpenEventA
TerminateThread
ResetEvent
GetVersionExA
LoadLibraryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetModuleHandleA
CreateEventA
GetModuleFileNameA
GetVersion
WaitForMultipleObjects
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
lstrcpyW
lstrcpynW
lstrcatW
GetSystemDefaultLangID
HeapFree
GetProcessHeap
HeapAlloc
WriteConsoleW
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LocalAlloc
LocalFree
GetStartupInfoW
GetSystemDirectoryW
LoadLibraryW
FreeLibrary
DeleteCriticalSection
GetVersionExW
InitializeCriticalSection
GetModuleHandleW
GetProcAddress
GetCurrentProcess
LeaveCriticalSection
EnterCriticalSection
ReleaseMutex
WaitForSingleObject
CompareStringW
SetEnvironmentVariableA
LCMapStringW
GetFileSize
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
ExitProcess
TerminateProcess
IsDebuggerPresent
HeapSetInformation
GetCommandLineW
CreateThread
ExitThread
GetSystemTimeAsFileTime
GetSystemInfo
VirtualProtect
RtlUnwind
DecodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapCreate
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetFilePointer
InterlockedExchange
SwitchToThread
InterlockedCompareExchange
CreateDirectoryW
GetCurrentDirectoryW
WritePrivateProfileStringW
WritePrivateProfileStructW
VirtualQuery
HeapDestroy
HeapReAlloc
HeapSize
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetStringTypeW
EncodePointer
GetCPInfo
user32
DestroyWindow
DefWindowProcW
wsprintfW
GetWindowLongW
CallWindowProcW
PeekMessageW
DispatchMessageW
UnregisterClassA
SetWindowLongW
PostThreadMessageW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetWindowRgn
ShowWindow
CharUpperW
CharNextW
MsgWaitForMultipleObjectsEx
TranslateMessage
advapi32
RegCreateKeyExA
RegSetValueExW
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
LookupAccountSidW
RegQueryInfoKeyW
RegQueryValueExW
RegEnumKeyExW
RegOpenKeyExW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegDeleteValueA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
shell32
SHGetFolderPathW
ole32
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantClear
VariantInit
SysStringLen
SysAllocString
SysFreeString
shlwapi
SHDeleteKeyW
Sections
.text Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 358KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24.7MB - Virtual size: 35.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE