Static task
static1
Behavioral task
behavioral1
Sample
2024-06-24_23780e7dcdc15c400a6e5abb0b9abc16_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-06-24_23780e7dcdc15c400a6e5abb0b9abc16_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-24_23780e7dcdc15c400a6e5abb0b9abc16_mafia
-
Size
334KB
-
MD5
23780e7dcdc15c400a6e5abb0b9abc16
-
SHA1
806916f75bf5d614f021b13c5d584330fade6e1d
-
SHA256
279c6daadf0407bcd578a62591d6abf21ff5eeecf3942e2988c350dac18e37bb
-
SHA512
35064f00b6391ca32b9030d8c453cf6d86e82d7a77cf4c1118c51a2affc920836e53751c411dbb0a46fe4a07ed04b6af23ea65b857af4689a5f93303fd5d2f7e
-
SSDEEP
6144:7+19vLTOFX4Ses9vJT0tGBmlYHP7a0umy6uibfL0lAh2:61keqgGBVHP7a0umbuCQlAh2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-24_23780e7dcdc15c400a6e5abb0b9abc16_mafia
Files
-
2024-06-24_23780e7dcdc15c400a6e5abb0b9abc16_mafia.exe windows:5 windows x86 arch:x86
c19530035b9f4235ba3da22dff2e23dc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetDCPenColor
GetTextCharacterExtra
GetCurrentObject
SetSystemPaletteUse
GetBkColor
SetPixel
UpdateColors
GetFontLanguageInfo
GetFontUnicodeRanges
SetTextAlign
SetTextCharacterExtra
SetTextJustification
GetPolyFillMode
GetClipRgn
GetNearestPaletteIndex
GetDCBrushColor
SetTextColor
user32
GetDlgItemInt
GetWindowLongA
EnableWindow
GetMenuCheckMarkDimensions
GetDlgItem
SetDlgItemTextA
PostMessageA
GetWindowContextHelpId
GetWindowDC
GetMenuItemCount
IsWindowEnabled
LoadIconA
GetQueueStatus
DrawTextA
ShowWindow
IsWindowUnicode
GetMenuState
RemovePropA
GetScrollPos
GetMenuItemID
GetForegroundWindow
EndDialog
GetCursor
SetFocus
CheckDlgButton
EndPaint
SetWindowTextA
BeginPaint
GetKeyboardType
WindowFromDC
GetMenu
SendMessageA
GetInputState
GetMenuContextHelpId
MoveWindow
CallWindowProcA
kernel32
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
HeapReAlloc
GetStringTypeW
WriteConsoleW
HeapSize
LCMapStringW
Sleep
GetTimeZoneInformation
ReadFile
MultiByteToWideChar
GetProcessHeap
SetEndOfFile
SetStdHandle
GetDriveTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
RtlUnwind
SetHandleCount
EnterCriticalSection
FatalAppExitA
GetCurrentProcess
GetProcAddress
IsProcessorFeaturePresent
QueryPerformanceCounter
GetFileType
GetDriveTypeA
WriteFile
GlobalHandle
FindResourceA
DeleteFileA
GetModuleHandleA
GlobalFlags
GlobalSize
GetLastError
GetStdHandle
MoveFileA
GetVersion
GetCurrentThreadId
LockResource
IsDebuggerPresent
GetTickCount
SetFilePointer
SizeofResource
LocalFlags
CloseHandle
CreateThread
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EncodePointer
DecodePointer
TerminateProcess
HeapAlloc
HeapFree
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetModuleFileNameW
HeapCreate
HeapDestroy
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
GetCurrentDirectoryW
SetCurrentDirectoryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
Sections
.text Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ