C:\Sridhar\Downloads\omniORB-4.1.6\src\appl\omniNames\omniNames.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_981dac06ea62cd2293b5377de0256f73_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_981dac06ea62cd2293b5377de0256f73_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-24_981dac06ea62cd2293b5377de0256f73_mafia
-
Size
1.4MB
-
MD5
981dac06ea62cd2293b5377de0256f73
-
SHA1
700d015b4bfc99272ff9602123cf0445833ad091
-
SHA256
479ce10542ca73854d2b83cc2bde0bfddd003eeaab483b04d2a8d7a566cb9193
-
SHA512
9d917cb2aaafe0bfd22b7041a8ebd902ca54eca5753b3f4eea8f6b473a1cb13503a33f1453af00cf11896120447ddc089249995825a0f5bbd8352d5c7a68bb18
-
SSDEEP
24576:j+8dKt1CmVIS4cndFRm5DgTnhpm5FDLncgdlIozvOpjm:WmWqEfm7LoozvO5m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-24_981dac06ea62cd2293b5377de0256f73_mafia
Files
-
2024-05-24_981dac06ea62cd2293b5377de0256f73_mafia.exe windows:5 windows x86 arch:x86
f29df47f07c23c6c705b7f2e0df2c15f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
connect
getpeername
recv
send
setsockopt
bind
listen
getsockname
accept
shutdown
socket
WSAIoctl
closesocket
WSASetLastError
ntohs
getservbyport
gethostbyaddr
htons
getservbyname
inet_ntoa
gethostbyname
select
__WSAFDIsSet
WSAGetLastError
ioctlsocket
WSAStartup
inet_addr
htonl
gethostname
WSACleanup
advapi32
RegQueryInfoKeyA
RegEnumValueA
RegOpenKeyExA
StartServiceCtrlDispatcherA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegQueryValueExA
RegEnumKeyExA
kernel32
GetCurrentDirectoryW
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
SetCurrentDirectoryW
SetStdHandle
HeapSize
GetLocaleInfoW
LoadLibraryW
SetConsoleCtrlHandler
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
HeapReAlloc
CompareStringW
SetEnvironmentVariableA
GetDriveTypeW
SetEndOfFile
GetProcessHeap
CreateFileW
GetFullPathNameA
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
CopyFileA
GetComputerNameA
LocalFree
lstrlenA
FormatMessageA
GetLastError
GetModuleFileNameA
Sleep
SetHandleInformation
GetProcAddress
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
InitializeCriticalSection
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreA
CloseHandle
WaitForSingleObject
TlsGetValue
GetSystemTime
TlsFree
TlsSetValue
SetThreadPriority
GetCurrentThreadId
DuplicateHandle
GetCurrentThread
GetCurrentProcess
TlsAlloc
ResumeThread
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
RtlUnwind
HeapFree
RaiseException
GetModuleHandleW
ExitProcess
WriteConsoleW
GetFileType
GetStdHandle
GetModuleFileNameW
DeleteFileA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetCommandLineA
HeapSetInformation
GetCurrentProcessId
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
ExitThread
CreateThread
LCMapStringW
GetCPInfo
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
IsProcessorFeaturePresent
SetLastError
HeapCreate
HeapDestroy
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
FatalAppExitA
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 226KB - Virtual size: 226KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ