R:\utility\ruinet\ruinet.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-15_cb6313154adb96829d76487ffab5ac34_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-15_cb6313154adb96829d76487ffab5ac34_mafia.exe
Resource
win10v2004-20240412-en
General
-
Target
2024-04-15_cb6313154adb96829d76487ffab5ac34_mafia
-
Size
412KB
-
MD5
cb6313154adb96829d76487ffab5ac34
-
SHA1
79c1e27a39937fadcf0fed742548cde1facc03e2
-
SHA256
b962d3cbb0b711d4f5a507da17c658c1d7189fd95a443218db0cea2821a16c5d
-
SHA512
7adb28c0855f99c5e460d3e1c0e6d6e4c7728a922c978e05fb30f90e6133a62b605ec220f33b7186f28cebfc3888058c54bf90eae1e6b7e14b261d1bc85b29d6
-
SSDEEP
12288:f8WD9zehz8TRlZVzI5ixWvkit4QibvXxQa:HeGlZe4xKt45X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-15_cb6313154adb96829d76487ffab5ac34_mafia
Files
-
2024-04-15_cb6313154adb96829d76487ffab5ac34_mafia.exe windows:5 windows x86 arch:x86
32fef279f5e4a54f18afafc2169f186b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
gethostname
gethostbyname
WSACleanup
WSAStartup
inet_ntoa
inet_addr
htonl
sendto
recvfrom
ntohs
ntohl
closesocket
socket
ioctlsocket
setsockopt
WSAIoctl
WSASocketA
htons
bind
WSAGetLastError
advapi32
RegQueryValueA
RegCloseKey
RegOpenKeyA
kernel32
RaiseException
CompareStringW
WriteConsoleW
SetEndOfFile
SetStdHandle
GetDriveTypeW
HeapSize
WaitForSingleObject
GetExitCodeProcess
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
CreateDirectoryA
RemoveDirectoryA
CreateProcessA
GetCurrentProcess
FindClose
GetLastError
FindNextFileA
FindFirstFileA
HeapFree
GetProcessHeap
HeapAlloc
GlobalMemoryStatus
Sleep
SetConsoleWindowInfo
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTextAttribute
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
SetConsoleCursorPosition
SetConsoleCursorInfo
GetConsoleCursorInfo
LocalFree
FormatMessageA
GetSystemTimeAsFileTime
Beep
DecodePointer
EncodePointer
SetConsoleCtrlHandler
GetProcAddress
GetModuleHandleW
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetCommandLineA
HeapSetInformation
DeleteFileA
MoveFileA
GetFileAttributesA
GetTimeZoneInformation
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetFileAttributesA
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
MultiByteToWideChar
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteFile
GetModuleFileNameW
GetFullPathNameA
CloseHandle
GetFileInformationByHandle
PeekNamedPipe
GetFileType
CreateFileA
GetCurrentDirectoryW
SetCurrentDirectoryW
SetHandleCount
GetStartupInfoW
RtlUnwind
CreateFileW
IsProcessorFeaturePresent
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
ReadFile
GetConsoleCP
SetFilePointer
FlushFileBuffers
HeapReAlloc
Sections
.text Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ