C:\norad\nsm\L4_5\src\cb\util\secinit\WinRel\Secinit.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_705a75f5b2eec3cd78e08bdb88465862_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_705a75f5b2eec3cd78e08bdb88465862_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_705a75f5b2eec3cd78e08bdb88465862_mafia
-
Size
651KB
-
MD5
705a75f5b2eec3cd78e08bdb88465862
-
SHA1
5f267ad2b4bbad5f268121ebbd9e3829a721cafd
-
SHA256
17e070995ba087c2820226fe441aaf978d5a882e29c62c5c724d080e40871a20
-
SHA512
25e7e3206342f710a55ab6f8f34f936de99be1d62a67d05b31f91fd60919af1310a3e27dc36288e2bab6b880a72147964e73a8210f6e375a0caaed7e72a5ab61
-
SSDEEP
12288:pTvbWzErLVs6fAQJ8qhiRIKy9oZ61kOhCIJhN0X06xeyq+JfFO2K9Sh+:pjbaErLVs6fAQJ8qhiRny9oZ61kOlJhs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-22_705a75f5b2eec3cd78e08bdb88465862_mafia
Files
-
2024-05-22_705a75f5b2eec3cd78e08bdb88465862_mafia.exe windows:5 windows x86 arch:x86
1a49107c85440a67d15eaa41b60c50a9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
dbghelp
SymGetLineFromAddr64
SymGetModuleInfo64
SymFromAddr
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymCleanup
SymSetOptions
SymInitialize
MiniDumpWriteDump
kernel32
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
SetEndOfFile
GetDriveTypeW
WriteConsoleW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeLibrary
GetLastError
GetProcAddress
FormatMessageA
GetModuleFileNameA
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CloseHandle
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetSystemTimeAsFileTime
GetShortPathNameA
FindClose
FindNextFileA
HeapSize
GetFileSizeEx
GetTempFileNameA
GetTempPathA
GetComputerNameA
GetVersionExA
GetModuleHandleA
IsBadWritePtr
OutputDebugStringA
LockFileEx
UnlockFileEx
TerminateProcess
WaitForSingleObject
CreateProcessA
DuplicateHandle
SetUnhandledExceptionFilter
GetSystemInfo
FlushFileBuffers
LockFile
UnlockFile
DeleteFileA
SetFilePointer
ReadFile
WriteFile
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
GetTickCount
GetCurrentThread
GetFileAttributesA
FindFirstFileA
FindFirstFileExA
HeapAlloc
HeapFree
ExitThread
CreateThread
HeapReAlloc
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
SetFileAttributesA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
DecodePointer
EncodePointer
SetConsoleCtrlHandler
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetModuleHandleW
ExitProcess
CreateDirectoryA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
MoveFileA
GetCommandLineA
HeapSetInformation
SetHandleCount
GetStdHandle
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
WideCharToMultiByte
GetConsoleCP
GetModuleFileNameW
HeapCreate
HeapDestroy
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CreateFileW
RtlUnwind
LCMapStringW
MultiByteToWideChar
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
InterlockedExchange
LoadLibraryW
FreeEnvironmentStringsW
advapi32
RegEnumValueA
RegOpenKeyExA
Sections
.text Size: 570KB - Virtual size: 570KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ