funcadd_ASL
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-08_0c3d3aa3aeba53e29c8a3cd31a5c2fda_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-08_0c3d3aa3aeba53e29c8a3cd31a5c2fda_mafia.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-05-08_0c3d3aa3aeba53e29c8a3cd31a5c2fda_mafia
-
Size
3.4MB
-
MD5
0c3d3aa3aeba53e29c8a3cd31a5c2fda
-
SHA1
a46a98b5dfc24addacadc9eeb4a427121ac1a186
-
SHA256
7d930a6301cf0f0da0d7fdfa94f49d31aec00d6dfde6097e01dbf004111e4fdb
-
SHA512
dbee4073579c4a1f0bc1f73e17caff650bdfbb8c906cd9bd11ec4f36e64af314ed5ccb5060fb7d5295638378bcab0b60967d1ec9c040368b97328dd17808cc4a
-
SSDEEP
98304:9Kw7ksIsRbeJf/2wXcCTVW4pwZx2aPMppKaAsOHJc:a/2IBRW4pwZmRZuc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-08_0c3d3aa3aeba53e29c8a3cd31a5c2fda_mafia
Files
-
2024-05-08_0c3d3aa3aeba53e29c8a3cd31a5c2fda_mafia.exe windows:5 windows x86 arch:x86
49c628444b96f0f0bce0203bfbeabb5e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
WaitForSingleObject
ResumeThread
CreateEventA
InterlockedCompareExchange
SetEvent
InterlockedExchangeAdd
InterlockedExchange
CloseHandle
TlsSetValue
TlsGetValue
GetCurrentProcess
GetThreadPriority
DuplicateHandle
GetCurrentThread
GetCurrentThreadId
ResetEvent
WaitForMultipleObjects
GetLastError
GetCurrentProcessId
SetThreadPriority
CreateSemaphoreA
ReleaseSemaphore
TlsAlloc
TlsFree
SetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
SetErrorMode
GetStdHandle
AllocConsole
WriteFile
ReadFile
GetCurrentDirectoryA
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RtlUnwind
GetCommandLineA
HeapSetInformation
GetDriveTypeW
GetFullPathNameA
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapFree
RaiseException
HeapAlloc
GetModuleHandleW
ExitProcess
DeleteFileA
SetConsoleCtrlHandler
HeapReAlloc
ExitThread
CreateThread
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
CreateProcessA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetTickCount
IsProcessorFeaturePresent
GetCurrentDirectoryW
GetLocaleInfoW
LoadLibraryW
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetFileAttributesA
CreateFileA
SetFilePointer
CreatePipe
GetExitCodeProcess
GetFileInformationByHandle
PeekNamedPipe
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
GetProcessHeap
CreateFileW
Exports
Exports
Sections
.text Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ