O:\CPPwrapper_VS2010\Release_RSspec\optimizerpro_silent.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_1df4b6ed37ecf5ee7a0c925674e70f76_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_1df4b6ed37ecf5ee7a0c925674e70f76_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_1df4b6ed37ecf5ee7a0c925674e70f76_mafia
-
Size
6.1MB
-
MD5
1df4b6ed37ecf5ee7a0c925674e70f76
-
SHA1
316433b05aae2988a086611395ccb13149cf7e6e
-
SHA256
4278faa08116361b2bdaa6056e115aebd69ad044d93a7fa2f97e338f08c4f313
-
SHA512
c016bf9b67754d54398f5ae6abce22eb2cb4fa472487ea2d25ccedbbce9a4cc0d3396f839bbeffd7ba3b6f9b24f5a3364afd3ec4cee1f122b3b51fdb4aa16a88
-
SSDEEP
196608:n+LShrC2ImopJ+u4gPt5eF3YEwEnopL3MXd+RcFVQ7zvIq6C:n+LoC2IdJZ4C5elYKnW3md+aSrqC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-11_1df4b6ed37ecf5ee7a0c925674e70f76_mafia
Files
-
2024-03-11_1df4b6ed37ecf5ee7a0c925674e70f76_mafia.exe windows:5 windows x86 arch:x86
3fc811e7d56ce21e107bef2f9aa7c14c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetVersionExW
GetExitCodeProcess
GetFileAttributesW
GetTempPathW
SetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
WriteFile
LockResource
Process32NextW
SizeofResource
DeleteFileW
GetCurrentProcessId
GetSystemTime
SetFileTime
WaitForSingleObject
CreateDirectoryW
SystemTimeToFileTime
CreateProcessW
LoadResource
CreateToolhelp32Snapshot
OpenProcess
SetErrorMode
SetEndOfFile
SetFilePointer
FindResourceA
CloseHandle
GetLastError
CreateFileW
GetModuleFileNameW
ReadFile
GetSystemTimeAsFileTime
GetProcessHeap
HeapFree
HeapAlloc
GetFileSize
Process32FirstW
HeapReAlloc
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
ExitProcess
GetStdHandle
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
GetCurrentThread
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FreeLibrary
LoadLibraryW
SetStdHandle
WriteConsoleW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetVolumeInformationW
FindFirstFileW
GetFileTime
VerSetConditionMask
VerifyVersionInfoW
LocalAlloc
IsWow64Process
GetVersion
LocalFree
GetEnvironmentVariableW
GetBinaryTypeW
ExpandEnvironmentStringsW
SetEvent
TerminateThread
CreateEventW
lstrcmpW
lstrlenW
advapi32
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
SetSecurityDescriptorGroup
AccessCheck
DuplicateToken
InitializeAcl
AllocateAndInitializeSid
SetSecurityDescriptorOwner
AddAccessAllowedAce
FreeSid
IsValidSecurityDescriptor
GetLengthSid
RegSetValueExW
RegCloseKey
RegFlushKey
RegCreateKeyExW
GetUserNameW
RegOpenKeyExW
shell32
CommandLineToArgvW
SHGetFolderPathW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
wininet
InternetReadFile
HttpOpenRequestA
InternetConnectA
HttpQueryInfoA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
InternetSetOptionW
InternetCrackUrlA
psapi
GetModuleFileNameExW
user32
GetSystemMetrics
iphlpapi
GetAdaptersInfo
Sections
.text Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ