D:\work\SSCap\trunk\Release\SSCap.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-31_417ae1cdbf7c5d3ac8a69d1d8446ac13_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-05-31_417ae1cdbf7c5d3ac8a69d1d8446ac13_mafia.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-31_417ae1cdbf7c5d3ac8a69d1d8446ac13_mafia
-
Size
3.4MB
-
MD5
417ae1cdbf7c5d3ac8a69d1d8446ac13
-
SHA1
09f790beb7fef1a58863b7aa508ce49d5afd823e
-
SHA256
6a1c8afdd84aad1a644f2d0eae5ea908880f164dabc7683536132bd7f0706ee6
-
SHA512
389ce460fb1c1594b937dcc3b27c8a7830473f1a4491dd03addacffeb548765a778bfc5e81a1e6826e295104fe0c0566dab53c5aa14e2aaf33d69b0eb1a95e5c
-
SSDEEP
98304:0CR3XesxN9XQmZ5ksKSisxfVNHvcUXyhcRCDbreIp68w1MeMP1AK:P3XesxNVQMADV2C68w1MeMt
Malware Config
Signatures
-
Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-31_417ae1cdbf7c5d3ac8a69d1d8446ac13_mafia
Files
-
2024-05-31_417ae1cdbf7c5d3ac8a69d1d8446ac13_mafia.exe windows:5 windows x86 arch:x86
7b327dfc8966701efde1acd9cc69d357
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
advapi32
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
SystemFunction036
shlwapi
PathIsUNCW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
kernel32
GetNumberFormatW
SearchPathW
GetUserDefaultLCID
SetErrorMode
VirtualProtect
FindResourceExW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
DecodePointer
EncodePointer
HeapFree
GetSystemTimeAsFileTime
HeapAlloc
GetTimeFormatW
GetDateFormatW
GetFileType
ExitThread
HeapReAlloc
VirtualAlloc
VirtualQuery
CreateDirectoryA
RtlUnwind
HeapQueryInformation
HeapSize
ExitProcess
SetStdHandle
SetUnhandledExceptionFilter
GetWindowsDirectoryW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
GetFileSizeEx
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
IsDBCSLeadByteEx
GetTempPathW
GetTempFileNameW
GetStdHandle
GetFileTime
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThread
GetLastError
CreateEventW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WaitForSingleObject
SetEvent
Sleep
CloseHandle
CreateThread
WriteFile
ReadFile
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetPrivateProfileStringW
WritePrivateProfileStringW
FindResourceW
LoadResource
SizeofResource
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
LockResource
InterlockedIncrement
InterlockedDecrement
DeleteFileW
GetCurrentDirectoryW
GetSystemDirectoryW
LocalReAlloc
GlobalHandle
GlobalReAlloc
GlobalGetAtomNameW
GetThreadLocale
GetPrivateProfileIntW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
GlobalFlags
FileTimeToLocalFileTime
FileTimeToSystemTime
FindFirstFileW
FindClose
lstrcmpA
SuspendThread
SetThreadPriority
ReleaseActCtx
CreateActCtxW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
InitializeCriticalSectionAndSpinCount
lstrcmpW
CopyFileW
GlobalSize
MulDiv
OpenMutexW
CreateMutexW
CreateFileW
SetThreadLocale
GetProfileIntW
lstrcpynW
DebugBreak
RaiseException
lstrcpyW
WinExec
lstrcatW
LocalAlloc
GetFileSize
CreateFileA
FreeResource
GetVersion
lstrcmpiW
DeactivateActCtx
lstrlenW
ActivateActCtx
GetCPInfo
Process32NextW
Process32FirstW
CreateProcessW
GetTickCount
LocalFree
CreateToolhelp32Snapshot
GetSystemInfo
GlobalFree
SetLastError
GlobalUnlock
MultiByteToWideChar
TerminateProcess
GetVersionExW
FormatMessageW
WideCharToMultiByte
GlobalAlloc
OpenProcess
GlobalLock
GetCurrentProcess
FreeLibrary
lstrlenA
ResumeThread
GetCurrentThreadId
TerminateThread
LCMapStringW
user32
ToUnicodeEx
DrawFrameControl
SetClassLongW
DestroyAcceleratorTable
SetParent
RegisterClipboardFormatW
GetNextDlgGroupItem
UnregisterClassW
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
BringWindowToTop
TranslateAcceleratorW
IsClipboardFormatAvailable
CopyImage
GetMenuDefaultItem
SetMenuDefaultItem
IsMenu
MonitorFromPoint
UpdateLayeredWindow
EnableScrollBar
UnionRect
CharUpperW
IsZoomed
GetAsyncKeyState
NotifyWinEvent
SetWindowRgn
SetLayeredWindowAttributes
EnumDisplayMonitors
CharNextW
CopyAcceleratorTableW
WaitMessage
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
PostQuitMessage
RealChildWindowFromPoint
MapVirtualKeyW
GetKeyNameTextW
IntersectRect
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
ShowScrollBar
IsWindowVisible
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
AdjustWindowRectEx
GetKeyboardState
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
EndPaint
BeginPaint
GetWindowDC
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
EndDialog
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
GetWindowTextLengthW
GetWindowTextW
GetScrollPos
SetScrollPos
GetClassNameW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
CheckMenuItem
GetMenuStringW
TranslateMessage
PeekMessageW
RegisterWindowMessageW
GetSystemMenu
SetFocus
IsIconic
InvalidateRgn
DrawIcon
LoadIconW
IsRectEmpty
SetForegroundWindow
GetMessageW
SetRectEmpty
GetCapture
DispatchMessageW
HideCaret
EqualRect
ScreenToClient
GetMessagePos
GetFocus
GetWindow
RedrawWindow
UpdateWindow
SetCapture
MessageBeep
ReleaseCapture
GetKeyState
GetNextDlgTabItem
ClientToScreen
PostMessageW
GetParent
WindowFromPoint
GetClientRect
CreateIconIndirect
GetWindowRgn
SubtractRect
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
GetUpdateRect
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
PostThreadMessageW
CharUpperBuffW
CopyIcon
InvertRect
LockWindowUpdate
SetCursorPos
GetIconInfo
DrawFocusRect
InflateRect
OffsetRect
TrackPopupMenuEx
LoadMenuW
DrawStateW
DestroyCursor
FrameRect
GetActiveWindow
DestroyMenu
SetCursor
RegisterClassW
CreateAcceleratorTableW
MessageBoxW
SetClipboardData
OpenClipboard
DeferWindowPos
GetKeyboardLayout
EmptyClipboard
CloseClipboard
EnableWindow
SendMessageW
IsWindow
GetDC
SendMessageA
CopyRect
DestroyIcon
GetSystemMetrics
InsertMenuW
RemoveMenu
GetMenuItemCount
LoadBitmapW
GetSysColorBrush
CreatePopupMenu
GetSysColor
GetDesktopWindow
GrayStringW
GetMenuState
ReleaseDC
SystemParametersInfoW
AppendMenuW
SetRect
ModifyMenuW
GetMenuItemInfoW
DrawEdge
DrawTextExW
CreateMenu
DeleteMenu
DrawIconEx
GetSubMenu
TabbedTextOutW
DrawTextW
GetMenuItemID
FillRect
GetCursorPos
GetWindowLongW
InvalidateRect
PtInRect
LoadCursorW
KillTimer
LoadImageW
GetWindowRect
SetTimer
gdi32
DeleteObject
SetPixel
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection
DeleteDC
GetBkMode
CreateHatchBrush
PatBlt
GetTextExtentPoint32W
BitBlt
GetStockObject
StretchBlt
CreateBitmap
SetBkColor
SetTextColor
CreateDIBitmap
RealizePalette
CreatePalette
CreatePatternBrush
UnrealizeObject
CreateRectRgn
SelectPalette
CombineRgn
CreateRectRgnIndirect
CreateDCW
GetTextMetricsW
CopyMetaFileW
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
GetClipBox
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
CreateCompatibleBitmap
GetLayout
SetLayout
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
GetObjectType
SetRectRgn
GetMapMode
DPtoLP
GetRgnBox
GetBkColor
GetTextColor
EnumFontFamiliesW
GetTextCharsetInfo
CreateRoundRectRgn
CreatePolygonRgn
CreateEllipticRgn
Polyline
Polygon
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
GetTextFaceW
SetPixelV
CreateCompatibleDC
Rectangle
ExtTextOutW
Ellipse
PtVisible
GetObjectW
Escape
CreatePen
RectVisible
GetPixel
TextOutW
CreateSolidBrush
SetTextAlign
msimg32
AlphaBlend
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
shell32
SHBrowseForFolderW
SHAppBarMessage
SHGetFileInfoW
DragQueryFileW
DragFinish
ShellExecuteExW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
SHGetDesktopFolder
Shell_NotifyIconW
ShellExecuteW
comctl32
InitCommonControlsEx
_TrackMouseEvent
ImageList_GetIconSize
ole32
CoRevokeClassObject
CoRegisterMessageFilter
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleLockRunning
CreateStreamOnHGlobal
OleGetClipboard
CoUninitialize
CoCreateInstance
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
ReleaseStgMedium
OleDuplicateData
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleIsCurrentClipboard
OleFlushClipboard
DoDragDrop
CoInitializeEx
OleInitialize
CoFreeUnusedLibraries
CoInitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
oleaut32
VariantClear
VariantInit
SysAllocStringLen
VariantChangeType
VariantCopy
DispCallFunc
LoadRegTypeLi
SysStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SysAllocString
VarBstrFromDate
OleCreateFontIndirect
SystemTimeToVariantTime
SysFreeString
VariantTimeToSystemTime
ws2_32
ntohl
inet_ntoa
recvfrom
sendto
__WSAFDIsSet
setsockopt
getpeername
ioctlsocket
connect
WSAStartup
inet_addr
htonl
select
WSAGetLastError
htons
getsockname
WSACleanup
recv
bind
socket
WSASetLastError
closesocket
gethostbyname
send
listen
accept
ntohs
oledlg
OleUIBusyW
gdiplus
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipDeleteGraphics
GdiplusStartup
GdipCloneImage
GdipSaveImageToFile
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdiplusShutdown
libintl3
ord27
ord51
ord26
ord35
wininet
HttpOpenRequestA
HttpQueryInfoA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpSendRequestW
HttpQueryInfoW
InternetSetOptionW
InternetReadFile
oleacc
LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow
imm32
ImmReleaseContext
ImmGetContext
ImmGetOpenStatus
winmm
PlaySoundW
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 553KB - Virtual size: 553KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 485KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 370KB - Virtual size: 370KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ