E:\Projects\2014\NTB-development\Model\Code\NTB_v0.1.3.2_CC\Release\NTB_v0.1.3.2_CC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-10_2f3537d8f5ef629af362180a7bb8b178_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-10_2f3537d8f5ef629af362180a7bb8b178_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-10_2f3537d8f5ef629af362180a7bb8b178_mafia
-
Size
247KB
-
MD5
2f3537d8f5ef629af362180a7bb8b178
-
SHA1
1dcf092b6bae7682679111656e6477dad36a2927
-
SHA256
48bffa5899edba4084aecc5551af2e583b93fe055321ed4c3ff4bfae334e9b20
-
SHA512
fc4013da950cb3968c9e57c6d1b6244540a9cb2fb262c220026372fba2ec066402241a3aac415cf5577c059398bbd39ba07971381a7b686f85e4f6e063aaabb5
-
SSDEEP
3072:OVFk1rq+xZueIzCn6wBtrBqhZPjsdsUJqfn/rkm0YLlN/bi1NOGz0SMz1C:OVFk1fZueIzCVtFMZ7UsL/owLlN2GSM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-10_2f3537d8f5ef629af362180a7bb8b178_mafia
Files
-
2024-05-10_2f3537d8f5ef629af362180a7bb8b178_mafia.exe windows:5 windows x86 arch:x86
7183b668ff91f98440e501e994827985
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetLastError
GetProcAddress
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
CloseHandle
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleW
CreateFileA
CreateFileW
SetEndOfFile
Sections
.text Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ