D:\beta12_XRelease\software\AiM_EXE\32\RS3\aim\AIM_FIXERS\FirewallCheck-32-ReleaseU.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-08_6fd81583d2f3a2977c93741a206c1177_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-03-08_6fd81583d2f3a2977c93741a206c1177_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-08_6fd81583d2f3a2977c93741a206c1177_mafia
-
Size
188KB
-
MD5
6fd81583d2f3a2977c93741a206c1177
-
SHA1
e837012a68f7ad0fa7243b9f42a3861ab760ffb0
-
SHA256
c1434ae539e88748a881e6fe1e25589f50b2a5aa06a92f1a50c113fb413f6de1
-
SHA512
a5b7b8507fcce366b32c5a090c4b8096df993f4d039d07e9b978c5ce40a44f05f6b25bd01ebe5beb50170988fd3c7d85ebd8c57a73041ee195d0284207b2dc30
-
SSDEEP
3072:6NsCRmzgUoKb52czg7YygeWp38TfVA8O4EgJ+l+bazD3wHJ1Ci:6NsCRmkUoKb5HzAmpefVA54EgEgp1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-08_6fd81583d2f3a2977c93741a206c1177_mafia
Files
-
2024-03-08_6fd81583d2f3a2977c93741a206c1177_mafia.exe windows:5 windows x86 arch:x86
9963274549f3f331607bd023482f085b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
DeleteFileW
FindFirstFileW
GetLastError
GetLongPathNameW
CompareStringW
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
LoadLibraryW
GetModuleHandleA
GetModuleFileNameA
GetModuleHandleW
GetModuleFileNameW
CloseHandle
GetFileInformationByHandle
CreateFileW
GetCurrentDirectoryW
Sleep
FindClose
FindNextFileW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
RaiseException
RtlUnwind
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
CreateDirectoryW
GetCPInfo
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetProcAddress
HeapSize
ExitProcess
InitializeCriticalSectionAndSpinCount
WriteFile
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
GetFullPathNameW
PeekNamedPipe
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetEnvironmentVariableA
shell32
ShellExecuteW
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysFreeString
SysStringLen
SysAllocString
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ