Static task
static1
Behavioral task
behavioral1
Sample
2024-02-25_a859f34bef4c787feb50c297974782dd_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-25_a859f34bef4c787feb50c297974782dd_mafia.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-25_a859f34bef4c787feb50c297974782dd_mafia
-
Size
742KB
-
MD5
a859f34bef4c787feb50c297974782dd
-
SHA1
44edbc5bc3f46a2e2343a08a4e141a7505c44f9f
-
SHA256
5e5c751142154727f2db91165bab7813dd459eb74612afea38850554e1eec5c5
-
SHA512
50b9916ff8ad696cf11406f04c348c8c3453c66a4daa278002531bfa2aae928c37aedc06f3b28229ababc9ec99012aa89b4c9220cfc5baca04aea26990146732
-
SSDEEP
12288:fiJgoVeIC/GtQ/pyyD+2hkwOwnSs7jNsCW3h5ttPK8lJQ0VfY9woLNAN49FgCnsd:fiyRks7OK8lJQ0FYuohANszrJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-25_a859f34bef4c787feb50c297974782dd_mafia
Files
-
2024-02-25_a859f34bef4c787feb50c297974782dd_mafia.exe windows:5 windows x86 arch:x86
9f46f3132f71294433d6dae384cf8a2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleWindow
GetPrivateProfileStringA
GetPrivateProfileIntA
FindFirstFileA
FindNextFileA
CloseHandle
CreateDirectoryA
CreateFileA
SetFilePointer
WriteFile
ReadFile
GlobalAlloc
GetFileSize
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetErrorMode
SetUnhandledExceptionFilter
CreateTimerQueue
DeleteTimerQueue
CreateTimerQueueTimer
TerminateThread
CreateIoCompletionPort
CreateThread
SetThreadPriority
GetSystemInfo
CreateSemaphoreA
ReleaseSemaphore
GetQueuedCompletionStatus
WaitForSingleObject
GetModuleHandleA
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
CreateProcessA
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
GetStringTypeW
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
HeapCreate
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
GetLastError
CreateMutexA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
ExitProcess
GetTickCount
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
IsProcessorFeaturePresent
SetLastError
TlsFree
CreateFileW
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetModuleHandleW
HeapSize
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
HeapAlloc
GetCPInfo
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
RaiseException
HeapFree
RtlUnwind
FreeLibrary
GetProcAddress
LoadLibraryW
user32
GetDC
wsprintfA
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
DestroyWindow
DialogBoxParamA
CheckMenuItem
GetMenu
DefWindowProcA
PostQuitMessage
EndDialog
GetDlgItem
SendMessageA
SetFocus
SetDlgItemTextA
ReleaseDC
DrawTextA
FillRect
SetRect
GetClientRect
SetWindowTextA
MessageBoxA
gdi32
SetBkColor
SetTextColor
SelectObject
SetBkMode
DeleteObject
CreateSolidBrush
CreateFontA
TextOutA
ws2_32
socket
htons
inet_addr
gethostbyname
connect
WSAGetLastError
closesocket
recv
send
WSAStartup
WSASocketA
htonl
bind
listen
WSASend
WSARecv
inet_ntoa
WSAAccept
sendto
WSAAsyncSelect
dbghelp
MiniDumpWriteDump
Sections
.text Size: 547KB - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 16.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ