Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_54494adc6ac598734dc07615d157ae3f_mafia.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-24_54494adc6ac598734dc07615d157ae3f_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_54494adc6ac598734dc07615d157ae3f_mafia
-
Size
538KB
-
MD5
54494adc6ac598734dc07615d157ae3f
-
SHA1
b261be9ae127d51200a56b3f1f6e78e15efcf1e1
-
SHA256
2dd8e1ed677f67a77cdc2a8d938c73f76eda9bb9bbc434b6a0322ffcf6da64f8
-
SHA512
a5280d028ac44a0b600835f6e63ec08cc24c6d6507b652d31645d97737a150b77e9bf809faa964b8c6cb75517eb365c07053223e127c95a497a2a64fd145db3d
-
SSDEEP
12288:soN2GJYlhGn0AXoYwDD7gDoZSjcAikXsC7V7+m2Sp0:soN2q0AXo/DPjZSjcScaIVSp0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-24_54494adc6ac598734dc07615d157ae3f_mafia
Files
-
2024-05-24_54494adc6ac598734dc07615d157ae3f_mafia.exe windows:5 windows x86 arch:x86
fedad8b6b90c248ef860de221a0dba26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetVersionExW
GetTickCount
Sleep
GetSystemDirectoryW
DeleteFileW
GetTempPathW
SetLastError
GlobalHandle
GlobalFree
GlobalAlloc
LockResource
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
GlobalUnlock
GlobalLock
MulDiv
lstrcmpW
InitializeCriticalSectionAndSpinCount
lstrlenA
ExitProcess
SetEvent
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
GetCommandLineW
LocalFree
lstrcpyW
FreeResource
CreateDirectoryW
GetProcessId
RemoveDirectoryW
TerminateProcess
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ReadFile
WriteFile
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
LoadLibraryW
FindFirstFileW
FindClose
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
GetCurrentThreadId
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
GetFileType
SetHandleCount
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetTimeZoneInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapReAlloc
GetConsoleMode
GetConsoleCP
HeapCreate
GetStdHandle
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
GetLastError
CreateFileW
GetProcessAffinityMask
user32
CharNextW
LoadIconW
GetClientRect
ScreenToClient
PtInRect
GetForegroundWindow
IsWindow
UnregisterClassA
SendMessageW
KillTimer
MessageBoxW
InvalidateRect
SetActiveWindow
GetDlgItem
ReleaseDC
GetDesktopWindow
GetWindowThreadProcessId
GetDC
wsprintfW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
DestroyWindow
MoveWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
DefWindowProcW
GetFocus
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
PostThreadMessageW
SendDlgItemMessageW
MapDialogRect
SetWindowContextHelpId
EndDialog
RegisterWindowMessageW
BeginPaint
EndPaint
IsChild
CallWindowProcW
SetFocus
GetWindow
GetClassNameW
GetSysColor
RedrawWindow
GetClassInfoExW
CreateWindowExW
CreateAcceleratorTableW
ClientToScreen
GetParent
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
DestroyAcceleratorTable
gdi32
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
SelectObject
advapi32
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
shell32
CommandLineToArgvW
Shell_NotifyIconW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitialize
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoReleaseServerProcess
CoAddRefServerProcess
oleaut32
UnRegisterTypeLi
RegisterTypeLi
DispCallFunc
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
VariantInit
SysFreeString
SysAllocString
SafeArrayCreateVector
VariantClear
VariantCopy
VarUI4FromStr
secur32
GetUserNameExW
winhttp
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle
Sections
.text Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ