Static task
static1
Behavioral task
behavioral1
Sample
2024-05-12_2ecbdd1a3b33b674f621ce440f9c18d3_mafia.exe
Resource
win7-20240221-en
General
-
Target
2024-05-12_2ecbdd1a3b33b674f621ce440f9c18d3_mafia
-
Size
3.0MB
-
MD5
2ecbdd1a3b33b674f621ce440f9c18d3
-
SHA1
a4dadc4d55107a47bd2bd97cd9c5eb3ae4ffb341
-
SHA256
c5a78e1a26d1abe23e3fcf598b01f2c325fd285cf55b9b1456c74953e162ce2a
-
SHA512
7ae731cda93c3f9e8f67e5276b64af2460f6658710c1faa6bc0a6523af3fb7a9bb1204e91090dc276d68a174fdfb83dc8522f496b7b8def14dee13b4b9fb940a
-
SSDEEP
49152:CG+aQoPQFENp83s90AA+Z8+YU3OkuebX+cCPPIth/Tc1ICHouA6k51zCqqyZIJoO:tvmKNp83s90AA+ZAU3Oku6EPPIz/Tc1i
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-12_2ecbdd1a3b33b674f621ce440f9c18d3_mafia
Files
-
2024-05-12_2ecbdd1a3b33b674f621ce440f9c18d3_mafia.exe windows:5 windows x86 arch:x86
22720efa138cfa9f998fd79aa8b4d84c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetStringTypeW
CompareStringW
GetTimeZoneInformation
QueryPerformanceCounter
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
GetDriveTypeW
GetProcessHeap
CreateFileW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetConsoleCtrlHandler
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
FatalAppExitA
SetHandleCount
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
IsValidCodePage
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
SetStdHandle
HeapSize
HeapQueryInformation
VirtualQuery
VirtualAlloc
RaiseException
RtlUnwind
FindFirstFileExA
GetDriveTypeA
GetFileInformationByHandle
CreateThread
ExitThread
GetSystemTimeAsFileTime
HeapReAlloc
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
HeapFree
LocalLock
LocalUnlock
FindResourceExW
VirtualProtect
SetErrorMode
SearchPathA
GetProfileIntA
InitializeCriticalSectionAndSpinCount
GetTempPathA
GetNumberFormatA
GetWindowsDirectoryA
GetFileSizeEx
SetFileAttributesA
GetFileAttributesExA
FileTimeToLocalFileTime
GetShortPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileA
lstrcmpiA
GetStringTypeExA
FileTimeToSystemTime
GetThreadLocale
GetACP
GetAtomNameA
GetOEMCP
GetCPInfo
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleFileNameW
ReleaseActCtx
CreateActCtxW
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
ReplaceFileA
GetUserDefaultLCID
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThread
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
InterlockedExchange
GetModuleHandleW
lstrcmpA
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetCurrentProcessId
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
lstrlenW
MulDiv
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetVersionExA
CompareStringA
LoadLibraryW
ActivateActCtx
DeactivateActCtx
MultiByteToWideChar
lstrcmpW
FindResourceA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
GetTickCount
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
SetFileTime
WriteFile
CreateDirectoryA
GetFileAttributesA
LocalFileTimeToFileTime
lstrlenA
GetCurrentDirectoryA
SystemTimeToFileTime
ReadFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringA
lstrcatA
lstrcpyA
GetModuleFileNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
DeleteFileA
FlushViewOfFile
FindClose
FindFirstFileA
GetSystemInfo
GlobalMemoryStatusEx
UnmapViewOfFile
MapViewOfFile
CloseHandle
CreateFileMappingA
GetLastError
CreateFileA
Sleep
FindResourceW
LoadResource
LockResource
SizeofResource
WriteConsoleW
WideCharToMultiByte
InterlockedCompareExchange
user32
SetRect
ShowOwnedPopups
RegisterClipboardFormatA
PostQuitMessage
GetMessageA
TranslateMessage
ValidateRect
LoadCursorA
DestroyCursor
RedrawWindow
SetCursorPos
InflateRect
IsZoomed
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
GetMenuBarInfo
LoadImageA
DestroyIcon
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
IntersectRect
SetRectEmpty
BringWindowToTop
TranslateAcceleratorA
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetWindowThreadProcessId
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
DrawStateA
MapVirtualKeyA
GetKeyNameTextA
ReleaseDC
GetDC
GetSystemMetrics
GetCursorPos
ReleaseCapture
SetCursor
LoadCursorW
SetCapture
KillTimer
SetTimer
ClientToScreen
SetWindowRgn
DrawIcon
FillRect
SystemParametersInfoA
OffsetRect
IsRectEmpty
InvalidateRect
IsIconic
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
ScrollWindowEx
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
GetSystemMenu
CheckDlgButton
RegisterWindowMessageA
LoadIconW
LoadIconA
SendDlgItemMessageA
WinHelpA
GetMenuItemInfoA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
WindowFromPoint
MessageBeep
NotifyWinEvent
SetScrollPos
GetScrollPos
EnableWindow
SendMessageA
PostMessageA
UpdateWindow
GetAsyncKeyState
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetClientRect
GetSubMenu
GetMenuItemID
GetMenuItemCount
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
GetParent
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CharUpperA
UnionRect
EnableScrollBar
UpdateLayeredWindow
GetMenuDefaultItem
MonitorFromPoint
IsMenu
GetTabbedTextExtentA
GetWindowRgn
EnumChildWindows
MapDialogRect
SubtractRect
GetDoubleClickTime
CallWindowProcA
GetMenu
GetWindowLongA
SetWindowLongA
SetWindowPos
GetWindowRect
GetWindow
IsWindow
SetFocus
GetFocus
RealChildWindowFromPoint
GetSysColorBrush
EnumDisplayMonitors
SetLayeredWindowAttributes
GetDialogBaseUnits
DeleteMenu
GetCapture
LoadMenuW
GetUpdateRect
SendNotifyMessageA
TranslateMDISysAccel
wsprintfA
IsChild
SetMenuDefaultItem
DefMDIChildProcA
DefFrameProcA
MapVirtualKeyExA
IsCharLowerA
IsClipboardFormatAvailable
GetDCEx
WaitMessage
CharUpperBuffA
CopyIcon
FrameRect
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
LockWindowUpdate
CreateAcceleratorTableA
GetKeyboardState
GetKeyboardLayout
ToAsciiEx
DrawFrameControl
DrawEdge
SetClassLongA
DestroyAcceleratorTable
DrawIconEx
GetNextDlgGroupItem
CopyImage
GetIconInfo
HideCaret
DrawFocusRect
InvertRect
UnregisterClassA
GetTabbedTextExtentW
CreateMenu
CopyAcceleratorTableA
WindowFromDC
InSendMessage
LoadAcceleratorsW
PostThreadMessageA
SetParent
CheckRadioButton
DrawMenuBar
gdi32
SetLayout
SetArcDirection
SetColorAdjustment
SelectClipRgn
GetClipRgn
CreateRectRgn
SelectClipPath
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
CreatePen
ExtCreatePen
CreateHatchBrush
CreateCompatibleBitmap
GetTextMetricsA
GetTextExtentPoint32A
CreateFontIndirectA
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
GetLayout
Rectangle
SetRectRgn
CombineRgn
GetMapMode
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
CreateRoundRectRgn
GetCharWidthA
CreateFontA
StretchDIBits
GetBkColor
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetTextAlign
GetTextFaceA
GetTextExtentPointA
GetTextExtentPoint32W
GetWindowOrgEx
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
GetCurrentObject
CreatePolygonRgn
Polyline
Polygon
OffsetRgn
GetRgnBox
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
CreateMetaFileA
CloseMetaFile
DeleteMetaFile
EnumFontFamiliesExA
RoundRect
ExtFloodFill
SetPaletteEntries
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
SetPixelV
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
ModifyWorldTransform
SetWorldTransform
SetGraphicsMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetStockObject
CreateSolidBrush
PatBlt
CreateRectRgnIndirect
CreateDIBSection
DeleteObject
BitBlt
Ellipse
LPtoDP
DPtoLP
SelectObject
CreateCompatibleDC
CreateEllipticRgn
CreateDCA
CopyMetaFileA
GetDeviceCaps
CreateBitmap
GetObjectA
GetViewportOrgEx
SetTextColor
SetBkColor
msimg32
TransparentBlt
AlphaBlend
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
OpenPrinterA
GetJobA
ClosePrinter
advapi32
RegCreateKeyExA
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
RegCloseKey
RegEnumKeyExA
RegOpenKeyExW
RegEnumValueA
GetFileSecurityA
SetFileSecurityA
RegDeleteValueA
RegSetValueExA
RegSetValueA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
CryptReleaseContext
shell32
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFileInfoA
SHAddToRecentDocs
DragQueryFileA
DragFinish
ShellExecuteA
SHBrowseForFolderA
ShellExecuteExA
SHGetMalloc
ExtractIconA
comctl32
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx
shlwapi
PathIsUNCA
PathStripToRootA
PathFindFileNameA
PathRemoveExtensionA
PathFindExtensionA
PathStripPathA
PathRemoveFileSpecW
ole32
CreateILockBytesOnHGlobal
OleCreateFromData
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
CreateBindCtx
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoCreateGuid
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
PropVariantCopy
CoDisconnectObject
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoUninitialize
CoInitialize
CoGetClassObject
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CreateStreamOnHGlobal
CoInitializeEx
OleRegEnumVerbs
OleRegGetMiscStatus
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
DoDragDrop
OleRun
CLSIDFromProgID
StgCreateDocfileOnILockBytes
OleLockRunning
OleSave
WriteClassStm
OleSaveToStream
OleQueryLinkFromData
OleQueryCreateFromData
RevokeDragDrop
RegisterDragDrop
OleSetMenuDescriptor
OleGetClipboard
CreateDataAdviseHolder
CreateOleAdviseHolder
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CoGetMalloc
CreateFileMoniker
CoLockObjectExternal
GetRunningObjectTable
OleIsRunning
CreateGenericComposite
CreateItemMoniker
OleGetIconOfClass
OleCreateLinkToFile
OleCreateFromFile
OleSetContainedObject
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
CoTaskMemFree
GetHGlobalFromILockBytes
StgOpenStorageOnILockBytes
OleLoad
OleCreate
OleCreateStaticFromData
OleCreateLinkFromData
oleaut32
SysStringLen
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
VariantCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayCopy
SafeArrayGetElement
SysStringByteLen
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
VarDateFromStr
VarBstrFromCy
VarBstrFromDec
VarDecFromStr
VarCyFromStr
VarBstrFromDate
SysAllocString
SysAllocStringByteLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
SafeArrayPtrOfIndex
VariantClear
oledlg
ord8
gdiplus
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
wldap32
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord46
ws2_32
bind
ntohs
htons
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
htonl
ntohl
getsockname
crypt32
CertFreeCertificateContext
oleacc
LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundA
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 527KB - Virtual size: 527KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ