Static task
static1
Behavioral task
behavioral1
Sample
2024-04-04_947cfd83ad4a2dbeedccb06884d1668d_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-04_947cfd83ad4a2dbeedccb06884d1668d_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-04_947cfd83ad4a2dbeedccb06884d1668d_mafia
-
Size
244KB
-
MD5
947cfd83ad4a2dbeedccb06884d1668d
-
SHA1
bed07bc7f6645d145386469e6cd7a74a36edba0a
-
SHA256
e1c95d56d51ced20b9b75b1ff12cde89bc25015639a136ba1480779188420dc8
-
SHA512
ca5964a65785e2202640bd8d30a5a31c0752c3e1ed3de16808734d54acda4eb0bd304774b51652198bd3dd22b37732488ee77201be24dd78f5904ebd35fdbe93
-
SSDEEP
3072:iQMYQ7A9mTsEHUrBk63mHYMgO+fMiI4XZqhhtols8:izN7jIGUC9HYNO+zJqh3F8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-04_947cfd83ad4a2dbeedccb06884d1668d_mafia
Files
-
2024-04-04_947cfd83ad4a2dbeedccb06884d1668d_mafia.exe windows:5 windows x86 arch:x86
bb61d22d0fbce56ee981682ac90c684d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapDestroy
InterlockedCompareExchange
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
CreateEventA
CloseHandle
Sleep
WaitForSingleObject
SetEvent
GetLastError
GetCurrentThreadId
SwitchToThread
SetLastError
InterlockedExchange
CreateEventW
CancelIo
WideCharToMultiByte
lstrlenW
ResetEvent
CreateWaitableTimerW
SetWaitableTimer
HeapCreate
LoadLibraryW
TryEnterCriticalSection
ResumeThread
SetThreadContext
GetThreadContext
VirtualAllocEx
CreateProcessA
GetSystemDirectoryA
GetExitCodeProcess
OpenProcess
GetTickCount
GetModuleFileNameW
CreateThread
GetConsoleWindow
CreateFileW
SetStdHandle
WriteConsoleW
GetStringTypeW
IsValidLocale
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
VirtualAlloc
GetProcAddress
VirtualFree
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
SetFilePointer
ReadFile
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
GetLocaleInfoW
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
InitializeCriticalSection
MultiByteToWideChar
RtlUnwind
RaiseException
ExitThread
GetSystemTimeAsFileTime
GetCommandLineW
HeapSetInformation
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
user32
DispatchMessageW
ShowWindow
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
GetInputState
PostThreadMessageA
advapi32
RegCreateKeyW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
ws2_32
WSAGetLastError
send
select
socket
gethostbyname
WSAEventSelect
connect
WSAIoctl
setsockopt
closesocket
WSACleanup
WSAStartup
WSACreateEvent
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAResetEvent
shutdown
WSACloseEvent
WSASetLastError
htons
recv
winmm
timeGetTime
Sections
.text Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ