D:\amigo_28\src\build\Release\amigo.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia
-
Size
784KB
-
MD5
53d100c45eb726f3f471ead02ccb7407
-
SHA1
5d779551271b9ead192afd5c6305dc768a60b013
-
SHA256
85b754bc848ccfbc8577928580a0e67c68112b2a80e6a6af0173883985d23a53
-
SHA512
13d9b118c06cba5219d381796a6adfccfc6da1a2f3d7a094865ef7eca9d8681ef55634b0d4ad459340bec7044f16572abdc0ba930857f154cba1715870ed39a5
-
SSDEEP
24576:zvKiH/ugOwnUFbG3g1GxSdxva8k87hV33kec:zyiH/qsUo3g4xSzva8k8tVHo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia
Files
-
2024-06-03_53d100c45eb726f3f471ead02ccb7407_mafia.exe windows:5 windows x86 arch:x86
7250af2dab9452395073aed06846fb6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecW
PathFileExistsW
kernel32
SetCurrentDirectoryW
LoadLibraryExW
GetModuleFileNameW
GetTempPathW
GetEnvironmentVariableW
CreateProcessW
CloseHandle
GetLastError
GetModuleHandleW
VirtualProtect
DuplicateHandle
GetExitCodeProcess
WaitForSingleObject
SizeofResource
LockResource
LoadResource
FindResourceW
VirtualFree
SetFilePointer
ReadFile
GetSystemInfo
FreeLibrary
VirtualAlloc
CreateFileW
lstrlenW
IsDebuggerPresent
CreateEventW
ExpandEnvironmentStringsW
GetCurrentProcessId
GetTickCount
ReleaseMutex
SetLastError
CreateMutexW
WriteFile
OutputDebugStringA
SetEnvironmentVariableW
GetUserDefaultLangID
InterlockedExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetNativeSystemInfo
GetVersionExW
OpenProcess
GetProcessId
SetInformationJobObject
VirtualQueryEx
HeapSetInformation
GetStdHandle
SetHandleInformation
ResumeThread
AssignProcessToJobObject
LocalAlloc
GetFileAttributesW
VirtualAllocEx
GetLongPathNameW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
QueryDosDeviceW
GetLocaleInfoW
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
CreateThread
GetCurrentThreadId
RtlCaptureStackBackTrace
InterlockedExchangeAdd
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
ResetEvent
SetEvent
WaitForMultipleObjects
LoadLibraryA
GetWindowsDirectoryW
SetEndOfFile
FlushFileBuffers
UnregisterWaitEx
RegisterWaitForSingleObject
GetModuleHandleExW
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
InterlockedIncrement
ReleaseSemaphore
InterlockedDecrement
RtlCaptureContext
CreateSemaphoreW
InitializeCriticalSection
GetThreadContext
SuspendThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
GetFileType
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetFullPathNameW
HeapAlloc
GetProcessHeap
SetStdHandle
LCMapStringW
GetCPInfo
RtlUnwind
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
WriteConsoleW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
CompareStringW
VirtualFreeEx
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
CreateRemoteThread
GetModuleHandleA
FormatMessageW
LocalFree
GetEnvironmentVariableA
GetCommandLineW
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
user32
GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
wsprintfW
MessageBoxW
CloseWindowStation
CharUpperW
userenv
GetProfileType
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
timeGetTime
advapi32
GetTraceEnableLevel
SetEntriesInAclW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CreateProcessAsUserW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegDisablePredefinedCache
RevertToSelf
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
SetThreadToken
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine2
SetCrashKeyValuePair
SetExperimentList3
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
Sections
.text Size: 405KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ