D:\amigo_28\src\build\Release\amigo.exe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_0014f9ecba4550e2e6f1799ad430ea93_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_0014f9ecba4550e2e6f1799ad430ea93_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_0014f9ecba4550e2e6f1799ad430ea93_mafia
-
Size
784KB
-
MD5
0014f9ecba4550e2e6f1799ad430ea93
-
SHA1
eb0ae2e1d0928b0e48866e6e6f24a9531eaf3e38
-
SHA256
1b7a7edbf8a474a49102f0472543e99727990c5b5bbd9fe4d70d5abf8bc34342
-
SHA512
bee6e6e183b02c186ccadc8332f2e5e6724556f2e3ea680b5d7a0be7cf00aaa67a644ff78525165406db1b33f65f5b61a54c0a138acd17dfbd14540583fdda10
-
SSDEEP
24576:uvKiH/ugOwnUFbG3g1GxSdxva8k87hV33kec:uyiH/qsUo3g4xSzva8k8tVHo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-12_0014f9ecba4550e2e6f1799ad430ea93_mafia
Files
-
2024-06-12_0014f9ecba4550e2e6f1799ad430ea93_mafia.exe windows:5 windows x86 arch:x86
7250af2dab9452395073aed06846fb6c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathRemoveFileSpecW
PathFileExistsW
kernel32
SetCurrentDirectoryW
LoadLibraryExW
GetModuleFileNameW
GetTempPathW
GetEnvironmentVariableW
CreateProcessW
CloseHandle
GetLastError
GetModuleHandleW
VirtualProtect
DuplicateHandle
GetExitCodeProcess
WaitForSingleObject
SizeofResource
LockResource
LoadResource
FindResourceW
VirtualFree
SetFilePointer
ReadFile
GetSystemInfo
FreeLibrary
VirtualAlloc
CreateFileW
lstrlenW
IsDebuggerPresent
CreateEventW
ExpandEnvironmentStringsW
GetCurrentProcessId
GetTickCount
ReleaseMutex
SetLastError
CreateMutexW
WriteFile
OutputDebugStringA
SetEnvironmentVariableW
GetUserDefaultLangID
InterlockedExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetNativeSystemInfo
GetVersionExW
OpenProcess
GetProcessId
SetInformationJobObject
VirtualQueryEx
HeapSetInformation
GetStdHandle
SetHandleInformation
ResumeThread
AssignProcessToJobObject
LocalAlloc
GetFileAttributesW
VirtualAllocEx
GetLongPathNameW
GetCurrentDirectoryW
MapViewOfFile
CreateFileMappingW
QueryDosDeviceW
GetLocaleInfoW
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
CreateThread
GetCurrentThreadId
RtlCaptureStackBackTrace
InterlockedExchangeAdd
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
ResetEvent
SetEvent
WaitForMultipleObjects
LoadLibraryA
GetWindowsDirectoryW
SetEndOfFile
FlushFileBuffers
UnregisterWaitEx
RegisterWaitForSingleObject
GetModuleHandleExW
GetQueuedCompletionStatus
CreateIoCompletionPort
PostQueuedCompletionStatus
InterlockedIncrement
ReleaseSemaphore
InterlockedDecrement
RtlCaptureContext
CreateSemaphoreW
InitializeCriticalSection
GetThreadContext
SuspendThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
GetFileType
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetFullPathNameW
HeapAlloc
GetProcessHeap
SetStdHandle
LCMapStringW
GetCPInfo
RtlUnwind
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
WriteConsoleW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
CompareStringW
VirtualFreeEx
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
CreateRemoteThread
GetModuleHandleA
FormatMessageW
LocalFree
GetEnvironmentVariableA
GetCommandLineW
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
user32
GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
wsprintfW
MessageBoxW
CloseWindowStation
CharUpperW
userenv
GetProfileType
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
timeGetTime
advapi32
GetTraceEnableLevel
SetEntriesInAclW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCreateKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
CreateProcessAsUserW
GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
TraceEvent
RegisterTraceGuidsW
RegDisablePredefinedCache
RevertToSelf
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
SetThreadToken
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine2
SetCrashKeyValuePair
SetExperimentList3
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
Sections
.text Size: 405KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ