Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_97dac94f2522f0fc171caf8eced868e3_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-24_97dac94f2522f0fc171caf8eced868e3_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_97dac94f2522f0fc171caf8eced868e3_mafia
-
Size
538KB
-
MD5
97dac94f2522f0fc171caf8eced868e3
-
SHA1
8839b59aed3e37cda8e0e5354fbcce15a1c78c08
-
SHA256
7ad4cf76260bca827a81be9492477839f93fcfe584709115b0305929ff661df5
-
SHA512
085262bdc4ead2ea05fbd62b9c88756d27edb54f46966250526b197c35be8cb1610f53fa4a2c0bc49331c3f681b9dc17ac4a89f525029c38713e98a4895fbcc1
-
SSDEEP
12288:KtfX0TYopeDp80Ee3vTgb4pzhOHsC7V7+m2C7:WP0TN0Ee3Lm2hTaIVC7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-24_97dac94f2522f0fc171caf8eced868e3_mafia
Files
-
2024-05-24_97dac94f2522f0fc171caf8eced868e3_mafia.exe windows:5 windows x86 arch:x86
fedad8b6b90c248ef860de221a0dba26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetVersionExW
GetTickCount
Sleep
GetSystemDirectoryW
DeleteFileW
GetTempPathW
SetLastError
GlobalHandle
GlobalFree
GlobalAlloc
LockResource
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
GlobalUnlock
GlobalLock
MulDiv
lstrcmpW
InitializeCriticalSectionAndSpinCount
lstrlenA
ExitProcess
SetEvent
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
GetCommandLineW
LocalFree
lstrcpyW
FreeResource
CreateDirectoryW
GetProcessId
RemoveDirectoryW
TerminateProcess
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ReadFile
WriteFile
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
LoadLibraryW
FindFirstFileW
FindClose
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
GetCurrentThreadId
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
GetFileType
SetHandleCount
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetTimeZoneInformation
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapReAlloc
GetConsoleMode
GetConsoleCP
HeapCreate
GetStdHandle
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
GetLastError
CreateFileW
GetProcessAffinityMask
user32
CharNextW
LoadIconW
GetClientRect
ScreenToClient
PtInRect
GetForegroundWindow
IsWindow
UnregisterClassA
SendMessageW
KillTimer
MessageBoxW
InvalidateRect
SetActiveWindow
GetDlgItem
ReleaseDC
GetDesktopWindow
GetWindowThreadProcessId
GetDC
wsprintfW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
DestroyWindow
MoveWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
DefWindowProcW
GetFocus
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
PostThreadMessageW
SendDlgItemMessageW
MapDialogRect
SetWindowContextHelpId
EndDialog
RegisterWindowMessageW
BeginPaint
EndPaint
IsChild
CallWindowProcW
SetFocus
GetWindow
GetClassNameW
GetSysColor
RedrawWindow
GetClassInfoExW
CreateWindowExW
CreateAcceleratorTableW
ClientToScreen
GetParent
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
DestroyAcceleratorTable
gdi32
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
SelectObject
advapi32
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
shell32
CommandLineToArgvW
Shell_NotifyIconW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitialize
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoReleaseServerProcess
CoAddRefServerProcess
oleaut32
UnRegisterTypeLi
RegisterTypeLi
DispCallFunc
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
VariantInit
SysFreeString
SysAllocString
SafeArrayCreateVector
VariantClear
VariantCopy
VarUI4FromStr
secur32
GetUserNameExW
winhttp
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle
Sections
.text Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ