Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_4f1c61f68ea3d01741ddbb70d9a4d6d9_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_4f1c61f68ea3d01741ddbb70d9a4d6d9_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_4f1c61f68ea3d01741ddbb70d9a4d6d9_mafia
-
Size
4.6MB
-
MD5
4f1c61f68ea3d01741ddbb70d9a4d6d9
-
SHA1
91fc82655453a7f17e6cdd6afc9e2ebe830394f2
-
SHA256
b2705a513520eeb00fa5088b6b1f8ef5458f5964de191821db50b821b60664c1
-
SHA512
1c4b9ac40d881554b08f58ecd30b8285cfd668e715f63c3ac3c3a7836941177060a30293c3342f15f13b3be8f109585389645b89bee6e8d433a6880923f356ec
-
SSDEEP
49152:FpvyTtPb2hI7SDN4GUNk05GEmot9hv1mlTMHrwnbJuFnPZ:DOaG4bmgeLw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_4f1c61f68ea3d01741ddbb70d9a4d6d9_mafia
Files
-
2024-06-12_4f1c61f68ea3d01741ddbb70d9a4d6d9_mafia.exe windows:5 windows x86 arch:x86
ff69ff5b858ab6dd8789aca82fa848ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
hpwdat32
?DAT_Terminate@@YAXXZ
?DAT_SetLimitDat@@YAXH@Z
?DAT_CreateField@@YAHPAUdb@@HPAD@Z
?DAT_SetFieldName@@YAHPAUdb@@HPAD1@Z
?DAT_CopyField@@YAHPAUdb@@HPAD0H1@Z
?DATFLD_NeedsQuoting@@YAHPADD@Z
?DAT_SetStringField@@YAHPAUdb@@HPAD1HH@Z
?DAT_WriteString@@YAHPAUdb@@PAD@Z
?DAT_WriteRecord@@YAHPAUdb@@@Z
?DAT_RawReadLastRecord@@YAHPAUdb@@PADH@Z
?DAT_ReadRecord@@YAHPAUdb@@@Z
?DAT_IsEOF@@YAHPAUdb@@@Z
?DAT_IsBOF@@YAHPAUdb@@@Z
?DAT_IsFieldQuoted@@YAHPAUdb@@PAD@Z
?DAT_MoveToRecord@@YAHPAUdb@@J@Z
?DAT_ObtainTrueRecordCount@@YAHPAUdb@@PAJ@Z
?DAT_GetRecordCount@@YAHPAUdb@@H@Z
?DAT_GetRecordCRC32@@YAKPAUdb@@@Z
?DAT_SetRecordNumber@@YAHPAUdb@@J@Z
?DAT_GetRecordNumberRegardless@@YAHPAUdb@@@Z
?DAT_DefineField@@YAHPAUdb@@HPADPAUflddesc@@@Z
?DAT_CloseTable@@YAHPAUdb@@@Z
?DAT_ClearFieldDefs@@YAHPAUdb@@@Z
?DAT_OpenTable@@YAHPAUdb@@@Z
?DAT_RemoveField@@YAHPAUdb@@HPAD@Z
?DAT_CheckTableExists@@YAHPAUdb@@PAD@Z
?DAT_GetTableCount@@YAHPAUdb@@@Z
?DAT_GetTableName@@YAHPAUdb@@HPADH@Z
?DAT_CloseDatabase@@YAHPAUdb@@@Z
?DAT_CheckDatabaseExists@@YAHPAUdb@@@Z
?DAT_CreateDatabase@@YAHPAUdb@@@Z
?DAT_OpenDatabase@@YAHPAUdb@@@Z
?DAT_GetDBDescription@@YAHPAUdb@@PADH@Z
?DAT_GetDBType@@YAPAXPAUdb@@@Z
?DAT_SetDBType@@YAHPAUdb@@PAX@Z
?DAT_SetProperty@@YAHPAUdb@@PAD1H@Z
?DAT_IsPropertySupported@@YAHPAUdb@@PAD@Z
?DAT_GetVersionInfoAll@@YAXPADH0@Z
?DAT_DeleteDB@@YAHPAUdb@@@Z
?DAT_Initialise@@YAHXZ
?DAT_GetDatabaseTypes@@YAHPAPAD@Z
?DAT_GetDatabaseCodes@@YAHPAPAD@Z
?DAT_GetDatabaseExtensions@@YAHPAPAD@Z
?DAT_GetFullStatus@@YAHPAUdb@@@Z
?DAT_CreateDB@@YAPAUdb@@XZ
?DAT_FieldTypeText@@YAPADE@Z
?DAT_GetRecordNumber@@YAHPAUdb@@@Z
?DAT_GetFieldInError@@YAHPAUdb@@PAUflddesc@@@Z
?DAT_GetStatusMessage@@YAPADPAUdb@@@Z
?DAT_GetStatus@@YAHPAUdb@@@Z
?DAT_IsDBType@@YAHPAUdb@@PAX@Z
?DAT_GetProperty@@YAHPAUdb@@PAD1HH@Z
?DAT_GetDBState@@YAHPAUdb@@@Z
?DAT_GetTableFieldCount@@YAHPAUdb@@@Z
?DAT_GetFieldInfo@@YAHPAUdb@@HPADPAUflddesc@@@Z
?DAT_GetStringField@@YAHPAUdb@@HPAD1H@Z
comctl32
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragEnter
ImageList_DragMove
ImageList_BeginDrag
ImageList_SetDragCursorImage
ImageList_GetImageInfo
ImageList_SetBkColor
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_Add
ImageList_Create
ImageList_Destroy
ord16
ImageList_GetImageCount
ImageList_Draw
ImageList_GetIconSize
ord17
rpcrt4
RpcStringFreeA
UuidToStringA
kernel32
GetCurrentDirectoryW
GetFileInformationByHandle
LoadLibraryW
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetHandleCount
GetOEMCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocaleInfoW
GetModuleFileNameW
IsProcessorFeaturePresent
HeapCreate
LCMapStringW
FlushFileBuffers
GetTimeZoneInformation
GetFullPathNameA
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetDateFormatA
GetTimeFormatA
HeapReAlloc
CreateDirectoryA
SetFilePointer
HeapAlloc
GetConsoleMode
GetConsoleCP
MoveFileA
FindFirstFileExA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleHandleW
GetStartupInfoW
HeapSetInformation
DeleteFileA
RtlUnwind
HeapFree
DecodePointer
EncodePointer
WriteConsoleW
CreateFileW
SetEndOfFile
GetStringTypeW
IsBadStringPtrA
RaiseException
GetCurrentThread
GetLogicalDriveStringsA
GetDriveTypeA
InterlockedExchange
PeekNamedPipe
SetEvent
WaitForMultipleObjects
WriteFile
ReadFile
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemTimeAsFileTime
OutputDebugStringA
GetLocaleInfoA
IsValidLocale
GetUserDefaultLCID
GetACP
TlsAlloc
TlsFree
TlsGetValue
ExitProcess
TlsSetValue
InterlockedDecrement
InterlockedIncrement
FindNextFileA
GetModuleFileNameA
LoadResource
LockResource
SizeofResource
TerminateProcess
WaitForSingleObject
GetModuleHandleA
GetCurrentProcess
IsValidCodePage
GetCPInfo
GetLocalTime
Sleep
GetCurrentProcessId
GetEnvironmentVariableA
FindResourceA
ExpandEnvironmentStringsA
GetTempFileNameA
GetFileTime
FindFirstFileA
FindClose
CopyFileA
GetFileAttributesA
CreateFileA
CloseHandle
GetFileType
FormatMessageA
LocalFree
GetProcessHeap
HeapSize
GlobalSize
SetErrorMode
SetCurrentDirectoryA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
DeleteCriticalSection
WideCharToMultiByte
GetCurrentThreadId
MultiByteToWideChar
SetLastError
GetLastError
MulDiv
GetCommandLineA
SetConsoleCursorPosition
FillConsoleOutputCharacterA
WriteConsoleA
GetStdHandle
GetConsoleScreenBufferInfo
ReadConsoleOutputCharacterA
FreeConsole
GetVersionExA
IsBadReadPtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
GetTempPathA
SetEnvironmentVariableA
EnumSystemLocalesA
CompareStringW
GetVolumeInformationA
user32
DestroyAcceleratorTable
FindWindowExA
GetWindowDC
EndPaint
BeginPaint
EnumDisplaySettingsA
ChangeDisplaySettingsA
PostThreadMessageA
ValidateRect
GetMessageA
UnionRect
GetDoubleClickTime
DrawIconEx
ChildWindowFromPoint
GetWindowTextA
GetClassNameA
MessageBeep
GetClassInfoA
GetDialogBaseUnits
CreateMenu
AppendMenuA
ModifyMenuA
RemoveMenu
InsertMenuItemA
InsertMenuA
CreatePopupMenu
DestroyMenu
GetWindowTextLengthA
HideCaret
DrawEdge
SetRect
DrawFrameControl
CreateAcceleratorTableA
CheckMenuRadioItem
CheckMenuItem
GetSysColorBrush
GetSubMenu
GetMenuItemID
SetTimer
DrawFocusRect
SetRectEmpty
OffsetRect
DrawStateA
CopyRect
DrawTextA
SetWindowRgn
GetDesktopWindow
GetSystemMenu
EnableMenuItem
DrawMenuBar
GetWindowPlacement
CreateDialogIndirectParamA
FlashWindow
IsZoomed
SetForegroundWindow
IsIconic
BringWindowToTop
GetDlgItem
CreateDialogParamA
InflateRect
PtInRect
UnregisterHotKey
RegisterHotKey
SetWindowsHookExA
GetMenuItemCount
GetMenuItemInfoA
SystemParametersInfoA
TranslateAcceleratorA
IsRectEmpty
ValidateRgn
GetClipboardFormatNameA
RegisterClipboardFormatA
wsprintfA
IsClipboardFormatAvailable
ShowCursor
AdjustWindowRectEx
SetMenuItemInfoA
KillTimer
MessageBoxA
GetKeyState
MsgWaitForMultipleObjects
PostMessageA
keybd_event
PeekMessageA
UnregisterClassA
RegisterClassA
LoadCursorA
LoadIconA
LoadBitmapA
LoadImageA
GetSystemMetrics
DdeFreeStringHandle
DdeUninitialize
DdeQueryStringA
DdeFreeDataHandle
DdeGetData
DdeCreateDataHandle
DdeGetLastError
DdeInitializeA
DdeDisconnect
DdePostAdvise
DdeConnect
DdeNameService
DdeCreateStringHandleA
GetMenuState
DdeClientTransaction
EndDeferWindowPos
BeginDeferWindowPos
MapWindowPoints
GetUpdateRgn
CreateWindowExA
DeferWindowPos
MoveWindow
UpdateWindow
SetCursorPos
ReleaseCapture
SetFocus
DestroyWindow
GetClientRect
GetSysColor
SetWindowTextA
IsWindow
FillRect
InvalidateRect
CallWindowProcA
DefWindowProcA
TrackPopupMenu
GetCapture
CallNextHookEx
UnhookWindowsHookEx
ChildWindowFromPointEx
GetIconInfo
DestroyIcon
DestroyCursor
CreateIconIndirect
SetCursor
SetMenu
GetWindowRect
SendMessageA
GetMessagePos
GetCursorPos
PostQuitMessage
TranslateMessage
DispatchMessageA
ReleaseDC
GetDC
MapVirtualKeyA
VkKeyScanA
GetAsyncKeyState
GetWindowLongA
GetWindow
GetActiveWindow
GetMessageTime
IsWindowEnabled
IsWindowVisible
IsDialogMessageA
ClientToScreen
ScreenToClient
RedrawWindow
SetParent
WindowFromPoint
GetParent
ScrollWindow
EnableScrollBar
SetScrollInfo
GetScrollInfo
SetCapture
SetWindowPos
ShowWindow
GetFocus
EnableWindow
SetWindowLongA
gdi32
GetCharABCWidthsA
GetDIBColorTable
CreateDIBitmap
GetDIBits
CreateDIBSection
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
ExtCreatePen
CreateHatchBrush
GetEnhMetaFileA
GetTextExtentExPointA
DeleteEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileA
PlayEnhMetaFile
CloseEnhMetaFile
EnumFontFamiliesExA
GetSystemPaletteEntries
SetAbortProc
StartDocA
EndDoc
StartPage
EndPage
CreateDCA
DeleteObject
CreateCompatibleDC
DeleteDC
SelectObject
StretchBlt
GetTextMetricsA
RealizePalette
SelectPalette
GdiFlush
CreateRectRgn
SetBrushOrgEx
ExcludeClipRect
GetDeviceCaps
CreateFontIndirectA
GetOutlineTextMetricsA
OffsetRgn
ExtCreateRegion
GetRegionData
SetBkColor
SetTextColor
SetBkMode
CreateSolidBrush
CreatePen
CreateBitmap
CreateCompatibleBitmap
BitBlt
GetTextExtentPoint32A
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
RectInRegion
ExtFloodFill
CreatePatternBrush
LineTo
MoveToEx
CreateICA
GetRgnBox
EqualRgn
PtInRegion
GetClipBox
Polyline
SetROP2
SetViewportOrgEx
GetPixel
SetPixel
PolyBezier
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
SetMapMode
GetBkColor
GetObjectType
SetStretchBltMode
ExtSelectClipRgn
Arc
Pie
Polygon
SetPolyFillMode
PolyPolygon
Rectangle
RoundRect
Ellipse
GetStockObject
MaskBlt
ExtTextOutA
StretchDIBits
GetObjectA
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
shell32
SHBrowseForFolderA
SHGetMalloc
SHGetPathFromIDListA
DragQueryFileA
DragFinish
DragAcceptFiles
ExtractIconExA
ExtractIconA
ShellExecuteA
SHGetFileInfoA
SHGetSpecialFolderLocation
DragQueryPoint
ole32
OleSetClipboard
ReleaseStgMedium
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
CoTaskMemAlloc
OleInitialize
OleUninitialize
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
CoTaskMemFree
oleaut32
VarBstrFromCy
SysStringLen
SysFreeString
comdlg32
PageSetupDlgA
PrintDlgA
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ChooseFontA
advapi32
GetUserNameA
RegDeleteKeyA
RegQueryValueExA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegCreateKeyExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegSetValueExA
RegCloseKey
wsock32
sendto
recvfrom
ord1109
getpeername
inet_addr
ntohs
WSAStartup
bind
htons
ioctlsocket
gethostbyname
connect
gethostname
send
recv
closesocket
htonl
setsockopt
socket
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 803KB - Virtual size: 803KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 51KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 714KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 336KB - Virtual size: 336KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ