Static task
static1
Behavioral task
behavioral1
Sample
2024-02-23_57d3dd9397321ebc4ab3984df3339ba4_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_57d3dd9397321ebc4ab3984df3339ba4_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_57d3dd9397321ebc4ab3984df3339ba4_mafia
-
Size
494KB
-
MD5
57d3dd9397321ebc4ab3984df3339ba4
-
SHA1
1327e477b673df492df823eb91aac12de71af1f9
-
SHA256
0a967b3c7955468026db81405ef2a048de24ff5fa8f4f3b994427c24da96005b
-
SHA512
1a7471ed3197393a69fdf88e6dd4dca8ed4385895cec358c0de68d74b41c322dfa2c2b667067e8d9cca867f3c4fe5227c2ca1017244e887d5964a33503e5e809
-
SSDEEP
12288:sLl+vxrCqyBW+Mp2xiryF5oeMpMgiTswYIBxbs/Vbd5Q9:sLl+ZCqyBW+M3ZtpMgiTuMx65G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_57d3dd9397321ebc4ab3984df3339ba4_mafia
Files
-
2024-02-23_57d3dd9397321ebc4ab3984df3339ba4_mafia.exe windows:5 windows x86 arch:x86
465101cf9bff9ae057e27024087b4063
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
IIDFromString
StringFromGUID2
shell32
SHGetFolderPathW
SHGetFolderPathA
user32
DispatchMessageW
DispatchMessageA
MsgWaitForMultipleObjectsEx
IsWindowUnicode
PeekMessageA
TranslateMessage
GetMessageW
GetMessageA
kernel32
FileTimeToSystemTime
LocalFree
LoadLibraryExW
WaitForSingleObject
OpenMutexA
GetNativeSystemInfo
GetCurrentProcess
GetSystemDirectoryA
GetModuleFileNameA
GetTempPathA
CreateFileA
GetTickCount
GetFileAttributesA
RemoveDirectoryA
FindClose
CloseHandle
DeleteFileA
Sleep
FormatMessageW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
PeekNamedPipe
SetHandleInformation
GetExitCodeProcess
CreateProcessA
TerminateProcess
ReadFile
WideCharToMultiByte
MultiByteToWideChar
FindResourceA
LoadResource
SizeofResource
LockResource
FreeLibrary
GetModuleHandleExW
LoadLibraryW
InterlockedDecrement
OpenProcess
CreateFileW
SetFilePointerEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
DeleteCriticalSection
GetLastError
GetProcAddress
SetDllDirectoryA
GetModuleHandleExA
SetFilePointer
SetEndOfFile
GetProcessHeap
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
FlushFileBuffers
SetStdHandle
GetCurrentDirectoryW
GetFileInformationByHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA
FindFirstFileExW
GetDriveTypeW
FileTimeToLocalFileTime
GetFullPathNameW
HeapSize
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
GetCPInfo
CreatePipe
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
HeapFree
GetCommandLineA
HeapSetInformation
GetSystemTimeAsFileTime
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
CreateDirectoryW
RaiseException
advapi32
RegQueryValueExA
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
CreateWellKnownSid
GetWindowsAccountDomainSid
CopySid
GetTokenInformation
OpenProcessToken
RegOpenKeyExA
RegCreateKeyExA
oleaut32
GetErrorInfo
SysFreeString
msi
ord91
ord117
ord141
ord168
ord189
ord158
ord115
ord159
ord8
ord137
ord67
ord31
ord160
ord44
ord204
version
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 270KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 92KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE