V:\chromium\src\build\Release\chrome_exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_a1d79436af7d8312c8ddafb15d8a65a4_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-24_a1d79436af7d8312c8ddafb15d8a65a4_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_a1d79436af7d8312c8ddafb15d8a65a4_mafia
-
Size
1.1MB
-
MD5
a1d79436af7d8312c8ddafb15d8a65a4
-
SHA1
743302c58dff8d8f293d0790db85c53df9275294
-
SHA256
c8f10b514ae980d9cb65a1c48d51a85fd3b49e210f4cecee9ba309cef19d5666
-
SHA512
f1b9618ff59cb77962af9a056f3e025220675577ccac1957545dd2aa06b3d5a7c7fd3b9f320225a88a43798a71c92302ccb8bad3e34777798984935d408c94c4
-
SSDEEP
24576:ltlEvDyTHdlCt6n/cRFRAg3srwUViaN/8RT41:SDyTHdSJOLsUVxNkq1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-24_a1d79436af7d8312c8ddafb15d8a65a4_mafia
Files
-
2024-05-24_a1d79436af7d8312c8ddafb15d8a65a4_mafia.exe windows:5 windows x86 arch:x86
f4addd35ed4bb822cda1eb2aa41ddb1e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecW
PathFileExistsW
kernel32
LockResource
LoadResource
FindResourceW
CreateFileW
GetSystemTimeAsFileTime
LocalFree
GetCurrentProcessId
GetTickCount
ReleaseMutex
GetLastError
SetLastError
CreateMutexW
SetFilePointer
WriteFile
OutputDebugStringA
FormatMessageA
CreateEventW
ExpandEnvironmentStringsW
UnmapViewOfFile
GetFileAttributesW
GetLongPathNameW
lstrlenW
ReadFile
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
FreeLibrary
VirtualFree
VirtualAlloc
QueryDosDeviceW
InterlockedExchange
SetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLangID
GetNativeSystemInfo
GetVersionExW
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
SetInformationJobObject
VirtualQueryEx
HeapSetInformation
TerminateProcess
ResumeThread
AssignProcessToJobObject
SetHandleInformation
GetLocaleInfoW
GetUserDefaultUILanguage
SizeofResource
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchangeAdd
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThreadId
SetEndOfFile
FlushFileBuffers
RtlCaptureStackBackTrace
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetSystemDirectoryW
GetWindowsDirectoryW
UnregisterWaitEx
RegisterWaitForSingleObject
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
ResetEvent
SetEvent
ReleaseSemaphore
VirtualQuery
RtlCaptureContext
InterlockedDecrement
LoadLibraryW
CreateSemaphoreW
InitializeCriticalSection
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
WriteProcessMemory
VirtualAllocEx
GetThreadContext
VirtualFreeEx
VirtualProtectEx
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
SuspendThread
GetThreadLocale
GetACP
LoadLibraryA
CreateFileA
GetTimeZoneInformation
GetStringTypeW
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
GetStartupInfoW
GetConsoleCP
GetConsoleMode
HeapAlloc
GetProcessHeap
SetStdHandle
GetFileType
HeapReAlloc
GetCPInfo
RtlUnwind
LCMapStringW
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
WriteConsoleW
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CompareStringW
SetEnvironmentVariableA
GetVersionExA
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleW
GetCurrentProcess
DuplicateHandle
QueueUserWorkItem
GetTempPathW
GetCommandLineW
CreateProcessW
CloseHandle
SetUnhandledExceptionFilter
ExitProcess
InterlockedCompareExchange
Sleep
GetModuleHandleA
SetCurrentDirectoryW
LoadLibraryExW
GetEnvironmentVariableW
GetModuleFileNameW
GetProcAddress
LocalAlloc
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
user32
UnregisterClassA
GetUserObjectInformationW
CharUpperW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
MessageBoxW
CloseDesktop
CloseWindowStation
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
SetThreadToken
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
RevertToSelf
RegDisablePredefinedCache
TraceEvent
CreateProcessAsUserW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
Sections
.text Size: 668KB - Virtual size: 667KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 357KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ