Static task
static1
Behavioral task
behavioral1
Sample
2024-06-06_5fb88ed103e285c87b217e00ba67c3ca_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-06_5fb88ed103e285c87b217e00ba67c3ca_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-06_5fb88ed103e285c87b217e00ba67c3ca_mafia
-
Size
551KB
-
MD5
5fb88ed103e285c87b217e00ba67c3ca
-
SHA1
4c2960c58ef09a0aa41ae00a8e7b0c3fc443aeee
-
SHA256
ce2b359b1b96e662b2bafbb89e76e0e3327d6cd532b19c3c8b085929f70851a9
-
SHA512
41748af9d9d65fc050839037ec3ea0ef3b3ac978120dc78bec888162117660c45a65e27d4af3a53334f6fb993c63d256f24565964e156ed685fb2f43688e9992
-
SSDEEP
12288:Trc6yl/WKTxZ6tk7DOc3mx8SCd3GxpDzWydsnmjhloGvqh3/6OLzk3:C/WKFh7DTmpDnd0VGvqwOLzk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-06_5fb88ed103e285c87b217e00ba67c3ca_mafia
Files
-
2024-06-06_5fb88ed103e285c87b217e00ba67c3ca_mafia.exe windows:5 windows x86 arch:x86
0b620857631d43a6a1937d5ae24587d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
InitializeCriticalSectionAndSpinCount
SizeofResource
LockResource
LoadResource
FindResourceW
CreateEventW
SetEvent
ReleaseMutex
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetUserDefaultLCID
Sleep
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
CreateMutexW
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesA
AreFileApisANSI
SetEnvironmentVariableA
WideCharToMultiByte
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetTimeZoneInformation
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetStdHandle
ExitProcess
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ExpandEnvironmentStringsW
FindFirstFileW
FindClose
GlobalFree
CreateThread
lstrlenA
MultiByteToWideChar
WaitForSingleObject
LoadLibraryW
FreeLibrary
GetCurrentProcess
GetPrivateProfileStringW
GetTempPathW
WritePrivateProfileStringW
DeleteFileW
MoveFileW
lstrlenW
GetModuleHandleW
GetProcAddress
ReadFile
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
lstrcpyW
GetModuleFileNameW
GetCommandLineW
LocalFree
GetTempFileNameW
CreateFileW
WriteFile
GetLastError
CloseHandle
CompareStringW
SetLastError
TlsFree
LCMapStringW
HeapReAlloc
GetStartupInfoW
GetVersionExW
HeapSetInformation
GetCPInfo
VirtualQuery
GetSystemInfo
VirtualProtect
RtlUnwind
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
VirtualAlloc
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
GetFileAttributesW
GetTempPathA
SetFilePointer
FlushFileBuffers
SetEndOfFile
GetFileSize
LockFile
LockFileEx
UnlockFile
GetFullPathNameA
GetFullPathNameW
LoadLibraryA
GetSystemTime
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
InterlockedPushEntrySList
InterlockedCompareExchange
CreateFileA
TlsAlloc
DeleteFileA
user32
GetSubMenu
LoadMenuW
SendMessageW
LoadBitmapW
SystemParametersInfoW
SetCursor
GetSysColor
SetWindowLongW
PostThreadMessageW
TranslateMessage
wsprintfW
CharNextW
GetWindowLongW
PostMessageW
SetWindowPos
GetClientRect
SetLayeredWindowAttributes
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
MessageBoxW
EndDialog
TrackPopupMenu
LoadCursorW
PtInRect
GetWindowRect
GetCursorPos
DispatchMessageW
GetMessageW
RegisterWindowMessageA
gdi32
CreateSolidBrush
GetObjectW
CreateFontIndirectW
CreateRoundRectRgn
GetStockObject
SelectObject
PatBlt
PaintRgn
DeleteObject
SetTextColor
SetBkColor
FrameRgn
advapi32
GetUserNameW
ImpersonateSelf
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegCloseKey
RegCreateKeyExW
shell32
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
ole32
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
OleInitialize
CoInitialize
CoUninitialize
StringFromGUID2
CoCreateGuid
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeEx
CoInitializeSecurity
CLSIDFromProgID
CoTaskMemAlloc
oleaut32
SafeArrayCreateVector
VariantChangeType
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarUI4FromStr
SysFreeString
SysAllocStringLen
SysAllocString
VariantCopy
VariantClear
VariantInit
GetErrorInfo
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ