C:\Users\delroth\buildslave\release-win-x86\build\Binary\Win32\DSPTool.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-13_96f86eb3b899ad2a5417f7290718b834_mafia.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-13_96f86eb3b899ad2a5417f7290718b834_mafia.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-06-13_96f86eb3b899ad2a5417f7290718b834_mafia
-
Size
589KB
-
MD5
96f86eb3b899ad2a5417f7290718b834
-
SHA1
f577924c867295106783e9c24791b13c0ba9783f
-
SHA256
8ee31fedc525afb65705321f4a35037846243fd319117a5dfa7fe62356fd994c
-
SHA512
66dc77e7ddd918903694c590ce4f964b57f00e4e2f0d1b602d2e38316fae75d3fe3c06c5b1e9b900169e4ad741f743a73303df3903c63e578c8b68e38218141d
-
SSDEEP
12288:c0KDh2O5FMFeBeSAJDzlA7WrmC90Wz/j1lGG+aPZyPG1riZ9D7E:sjEbdy7cmCyWLj1lXDB+G1N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-13_96f86eb3b899ad2a5417f7290718b834_mafia
Files
-
2024-06-13_96f86eb3b899ad2a5417f7290718b834_mafia.exe windows:5 windows x86 arch:x86
b54f2e304927c6ada2249601a131c88e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
winmm
timeEndPeriod
timeBeginPeriod
timeGetTime
kernel32
GetLastError
CreateDirectoryW
MoveFileW
ReplaceFileW
CopyFileW
DeleteFileW
RemoveDirectoryW
FindNextFileW
FindClose
FindFirstFileW
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
IsDebuggerPresent
FormatMessageA
GetStdHandle
FreeConsole
SetConsoleWindowInfo
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
WriteConsoleW
SetConsoleTextAttribute
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
SetConsoleTitleW
AllocConsole
GetConsoleWindow
WriteConsoleOutputAttribute
WriteConsoleOutputCharacterW
ReadConsoleOutputAttribute
ReadConsoleOutputCharacterW
CreateEventW
CloseHandle
SetEvent
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetCommandLineA
HeapSetInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetFileType
ReadFile
SetEndOfFile
HeapFree
HeapAlloc
GetProcessHeap
SetEnvironmentVariableA
GetCurrentDirectoryA
OpenProcess
FlushFileBuffers
GetDriveTypeW
FindFirstFileExW
GetFullPathNameA
GetFullPathNameW
GetSystemTimeAsFileTime
VirtualFree
GetTimeFormatA
GetDateFormatA
GetProcAddress
GetModuleHandleW
ExitProcess
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
WriteFile
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
SetStdHandle
SetFilePointer
GetConsoleCP
GetConsoleMode
CreateFileW
GetCurrentDirectoryW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LoadLibraryW
HeapReAlloc
CompareStringW
VirtualAlloc
IsWow64Process
SetCurrentDirectoryA
GetTimeZoneInformation
VirtualProtect
user32
ShowWindow
MessageBoxW
MoveWindow
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
psapi
GetProcessMemoryInfo
Sections
.text Size: 453KB - Virtual size: 453KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ