F:\cancun\src\build\Release\delegate_execute.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_fb711ace9ef5416e88eb109f5c1f0f41_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_fb711ace9ef5416e88eb109f5c1f0f41_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_fb711ace9ef5416e88eb109f5c1f0f41_mafia
-
Size
944KB
-
MD5
fb711ace9ef5416e88eb109f5c1f0f41
-
SHA1
6b6c13d2d454a2ddb2fb88a46002db6c36a5f450
-
SHA256
5d359efb816fbbc0b330c2f04c6064111dcaef15973f1b7bac5d31bf58026019
-
SHA512
66d9a715d3f006844579518e75b23a50698456dfcf1d40f1ce76cce7e4bdc5f395a44dcc195ab492b8f4ad89967d65fdc1285556ca788d7813493cbb17c9dcc2
-
SSDEEP
12288:z0W1NhGQNFCY1mPxWkrQpJPIsUG3OBSLCpEe9YLWodYOJY2hGsrIVF2vUK:zjNwQNX5k8JPtUyG2e94WodUsnx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_fb711ace9ef5416e88eb109f5c1f0f41_mafia
Files
-
2024-02-23_fb711ace9ef5416e88eb109f5c1f0f41_mafia.exe windows:5 windows x86 arch:x86
1ae205abdb70dad1d57d6dff3821407c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetCrackUrlW
kernel32
CompareStringW
CreateFileA
GetUserDefaultUILanguage
GetEnvironmentVariableW
SetEnvironmentVariableW
OpenMutexW
GetCommandLineW
SetEvent
CreateEventW
CreateThread
GetCurrentThreadId
Sleep
WaitForSingleObject
OpenProcess
CreateProcessW
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
InterlockedDecrement
GetThreadLocale
LockResource
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
LoadLibraryW
SetStdHandle
WriteConsoleW
WTSGetActiveConsoleSessionId
InterlockedIncrement
CloseHandle
lstrcmpiW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
SetEnvironmentVariableA
LocalAlloc
LocalFree
InterlockedExchange
LoadLibraryA
ExpandEnvironmentStringsW
GetCurrentProcess
GetCurrentProcessId
GetTickCount
ReleaseMutex
SetLastError
CreateMutexW
SetFilePointer
CreateFileW
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
GetFileTime
UnmapViewOfFile
GetFileAttributesW
CreateDirectoryW
GetTempPathW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
ReadFile
GetExitCodeProcess
HeapSetInformation
SetUnhandledExceptionFilter
DuplicateHandle
TerminateProcess
ResumeThread
AssignProcessToJobObject
GetStdHandle
GetTimeZoneInformation
GetSystemTimeAsFileTime
InterlockedCompareExchange
GetNativeSystemInfo
GetVersionExW
IsDebuggerPresent
QueryPerformanceCounter
SetEndOfFile
FlushFileBuffers
GetSystemDirectoryW
GetWindowsDirectoryW
InterlockedExchangeAdd
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
WideCharToMultiByte
InitializeCriticalSection
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetStartupInfoW
GetConsoleCP
GetConsoleMode
ExitProcess
HeapReAlloc
GetProcessHeap
RtlUnwind
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
GetLocaleInfoW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
user32
GetSystemMetrics
CharNextW
AllowSetForegroundWindow
IsImmersiveProcess
GetWindowThreadProcessId
PostThreadMessageW
GetMessageW
FindWindowExW
CharUpperW
TranslateMessage
MessageBoxW
DispatchMessageW
advapi32
RegQueryValueExW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
CreateProcessAsUserW
GetSidSubAuthority
GetSidSubAuthorityCount
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
InitializeSecurityDescriptor
ole32
CoAddRefServerProcess
CoCreateInstance
CoTaskMemRealloc
CoSetProxyBlanket
CoReleaseServerProcess
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoResumeClassObjects
StringFromGUID2
oleaut32
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
SysFreeString
VariantClear
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
winmm
timeGetTime
wtsapi32
WTSQueryUserToken
Sections
.text Size: 593KB - Virtual size: 593KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ