Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_ce03144bdbd3f8a8f2698be09e53f2cb_mafia.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-24_ce03144bdbd3f8a8f2698be09e53f2cb_mafia.exe
Resource
win10v2004-20240611-en
General
-
Target
2024-06-24_ce03144bdbd3f8a8f2698be09e53f2cb_mafia
-
Size
187KB
-
MD5
ce03144bdbd3f8a8f2698be09e53f2cb
-
SHA1
c7e080346ac6cf04bceeac4971992a5c99ad81da
-
SHA256
c141241558fc9e6ac6e69ae3ea100ea0edcab8975281d316d75ab10d24b4ff6a
-
SHA512
fb8286a99a592107192a1ccdf0c0b720ece9b2a73745f42819861c6738d3ab7a02a302aa4ad70cc3a179d9586894f70d8d2b1ff46557c552e3a8b922d3f03c0e
-
SSDEEP
3072:u1CnXYxTVZlVmAqfXv10yopnhlcI6a5fOOQ2XRw/hmQHYPq:u1CoVyjtmheIB5fOZ2BKr+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-24_ce03144bdbd3f8a8f2698be09e53f2cb_mafia
Files
-
2024-06-24_ce03144bdbd3f8a8f2698be09e53f2cb_mafia.exe windows:5 windows x86 arch:x86
5e2f9c0a77f8e447708a4398e478c254
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetLastActivePopup
IsWindowVisible
IsIconic
ShowWindow
GetForegroundWindow
SetForegroundWindow
GetParent
GetClassNameA
EnumWindows
GetWindowLongA
GetWindowThreadProcessId
kernel32
GetDriveTypeA
SetEnvironmentVariableA
CompareStringW
CreateFileW
GetProcessHeap
SetEndOfFile
GetDriveTypeW
SetStdHandle
WriteConsoleW
LoadLibraryW
GetTimeZoneInformation
HeapReAlloc
IsValidLocale
TlsFree
FreeLibrary
TlsSetValue
TlsGetValue
GetProcAddress
LoadLibraryA
TlsAlloc
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
CreateProcessA
GetCurrentDirectoryA
SetThreadLocale
GetSystemDefaultLCID
DeleteFileA
GetModuleFileNameA
GetLastError
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
Sleep
GetCurrentThreadId
SetCurrentDirectoryA
CreateMutexA
Process32Next
Process32First
CreateToolhelp32Snapshot
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
HeapFree
RaiseException
RtlUnwind
GetCurrentProcessId
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCPInfo
HeapAlloc
LCMapStringW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapCreate
GetModuleHandleW
SetLastError
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
ExitProcess
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetStringTypeW
GetLocaleInfoW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
Sections
.text Size: 137KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ