D:\builds\workspace\XCORE_7_5_0\common\utils\tiffconvert\Release\Unicode_MT\TiffConvert.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-02_96224971184aac1c5977c7aebace37ec_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-02_96224971184aac1c5977c7aebace37ec_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-02_96224971184aac1c5977c7aebace37ec_mafia
-
Size
788KB
-
MD5
96224971184aac1c5977c7aebace37ec
-
SHA1
1aed2feb208b0daf7febf4e370655bbeae29a828
-
SHA256
2dac8bb65b6b5c38cfa17c6f1691721e62852c56be49faedd5c911d796392e0f
-
SHA512
9e35c79de5753fdaecd84ccdde1208ee81c0465e501577d03d0fd53983820010c5784664549be0dab893b493e08681a2457b2ce1f8d333518ad2f8e6d61690a0
-
SSDEEP
12288:QPwfbvIrWQCUf87fau1OuStYQ4OT4JMiCzD13ROFoU6Z:QYfbKWAkW4OToiRhOFO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-02_96224971184aac1c5977c7aebace37ec_mafia
Files
-
2024-05-02_96224971184aac1c5977c7aebace37ec_mafia.exe windows:5 windows x86 arch:x86
9970827705e7a8c18b8c370ae048c349
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WaitForSingleObject
ReleaseMutex
CreateSemaphoreA
ReleaseSemaphore
CreateEventA
SetEvent
GetVersionExW
TryEnterCriticalSection
Sleep
ResetEvent
GetLocalTime
TerminateProcess
GetCurrentThreadId
GetExitCodeThread
FormatMessageA
FreeLibrary
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetStdHandle
WaitForMultipleObjectsEx
WaitForMultipleObjects
CreateMutexA
ExpandEnvironmentStringsA
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFileAttributesW
GetModuleHandleW
AreFileApisANSI
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemInfo
ExitProcess
TlsAlloc
TlsSetValue
TlsFree
GetCurrentProcess
GetCurrentProcessId
GetComputerNameA
TlsGetValue
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
GlobalFree
CreateFileA
GetLastError
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetFileSize
WriteFile
ReadFile
LocalFree
SetLastError
CreateFileW
SetFilePointer
SetEndOfFile
FlushFileBuffers
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
GlobalSize
GlobalAlloc
LeaveCriticalSection
EnterCriticalSection
MoveFileExA
SearchPathA
LoadLibraryW
GetTimeZoneInformation
HeapSize
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
CompareStringW
GetDateFormatA
GetTimeFormatA
LCMapStringW
SetConsoleCtrlHandler
GetFileType
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetFileAttributesA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
GetLocaleInfoW
HeapFree
RaiseException
RtlUnwind
GetCommandLineA
HeapSetInformation
HeapAlloc
HeapReAlloc
user32
FillRect
SetRect
DrawTextW
gdi32
SetStretchBltMode
CreateFontIndirectW
CreateBitmap
CreateCompatibleDC
GetBitmapBits
DeleteDC
CreatePen
SelectObject
MoveToEx
LineTo
DeleteObject
SetBkMode
SetTextColor
CreateSolidBrush
SetTextAlign
ExtCreatePen
SetROP2
StretchDIBits
PatBlt
advapi32
ReportEventA
DeregisterEventSource
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegisterEventSourceA
ws2_32
htons
inet_ntoa
getservbyname
gethostbyname
gethostbyaddr
bind
closesocket
socket
getsockname
getpeername
ntohs
ioctlsocket
ntohl
__WSAFDIsSet
getsockopt
send
recv
select
WSACleanup
WSAGetLastError
WSAStartup
inet_addr
accept
listen
WSAEventSelect
shutdown
WSAEnumNetworkEvents
connect
Sections
.text Size: 500KB - Virtual size: 499KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ