E:\buildVersion\br_bugfix_PC_V7R3B04D016\inodemgr\Build\ReleasePdb\DAMSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_c0061c266988a74d2d3d4d210eb1e231_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-31_c0061c266988a74d2d3d4d210eb1e231_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-31_c0061c266988a74d2d3d4d210eb1e231_mafia
-
Size
5.5MB
-
MD5
c0061c266988a74d2d3d4d210eb1e231
-
SHA1
0bff8fe0b61d438d121739a312af5a2cd97f7bdc
-
SHA256
76646350dfa2246bccf620254b9ecdac800de1dc7b03b0b7aeceaa77c8746481
-
SHA512
0f65ea494a883a7f1e39877d1ab5debb5b61aa869438811c034085c5d7edfa86e10d205ec08e1a45e930052a490f04d97fdb07d7f4a0892708dd8c3b86836fe1
-
SSDEEP
98304:8sR+nQxI0ecWlbl8oSFTilIbrLsgGresIwh4iFjU69eg91apheHK8wkrAoVuirKL:FhsbOilIb/dxwOilz9lvuEH1wkrAQXr4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-31_c0061c266988a74d2d3d4d210eb1e231_mafia
Files
-
2024-05-31_c0061c266988a74d2d3d4d210eb1e231_mafia.exe windows:5 windows x86 arch:x86
4be4fbfa6a02bd3e2423bad7be7c6577
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
lstrlenA
FormatMessageA
LocalAlloc
GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
ReadFile
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentProcess
GetPrivateProfileIntA
MultiByteToWideChar
FindClose
LocalFree
FindFirstFileA
SetFileAttributesA
GetFileAttributesA
RemoveDirectoryA
GetTickCount
GetFileAttributesExA
CreateProcessA
GetStartupInfoA
CreatePipe
LoadLibraryW
FreeLibrary
FlushFileBuffers
GetModuleHandleA
GetProcAddress
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
OpenMutexA
GetUserDefaultUILanguage
Sleep
CreateEventA
SetEvent
DeleteFileA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetModuleFileNameA
CreateDirectoryA
GetLocalTime
CreateFileA
GetLastError
SetFilePointer
CreateFileW
WriteFile
GetCurrentThreadId
CloseHandle
WriteConsoleW
SetEndOfFile
GetProcessHeap
FindNextFileA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
InitializeCriticalSectionAndSpinCount
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
user32
MessageBoxA
ExitWindowsEx
advapi32
EqualSid
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
FreeSid
RegDeleteValueA
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateGuid
Sections
.text Size: 280KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ