Static task
static1
Behavioral task
behavioral1
Sample
2024-06-26_44d0e7753e5e40231be7c7902fc7657d_mafia.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-06-26_44d0e7753e5e40231be7c7902fc7657d_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-26_44d0e7753e5e40231be7c7902fc7657d_mafia
-
Size
14.1MB
-
MD5
44d0e7753e5e40231be7c7902fc7657d
-
SHA1
e755cf1d7d15883e2aaa598c0466c2b78cb6f968
-
SHA256
c929abac70998995f0bcbbfe913a408c0b487e8c33c16199d269c232d3dda932
-
SHA512
095e4c5ca659848eccf780e3d165c2b0d6b7c1d24f85dd6e779768a8bcb299d59cb8681708e0c270dd27c7b5d59844cac911d52f6d9e8c400d27f8cf0be46c7f
-
SSDEEP
393216:Ax+I1pVEanRFM6fYGKWzQglJo6mZnKxr9Wwr4T:Ax+I17/M6fWIQmJHmdk1rw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-06-26_44d0e7753e5e40231be7c7902fc7657d_mafia
Files
-
2024-06-26_44d0e7753e5e40231be7c7902fc7657d_mafia.exe windows:5 windows x86 arch:x86
18a2992ee9eb8b29379b13914fbd88ab
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetVolumeInformationA
LeaveCriticalSection
lstrcmpiA
EnterCriticalSection
lstrlenA
SetCurrentDirectoryA
GetCurrentDirectoryA
DeleteFileA
GetTempFileNameA
GetTempPathA
GetVersion
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEndOfFile
SetFilePointer
SetFileTime
GetFullPathNameA
GetDriveTypeA
GetStdHandle
ReadFile
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
CreateProcessA
GetStartupInfoA
DosDateTimeToFileTime
SetFileAttributesA
GetFileAttributesA
GetFileTime
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
SetVolumeLabelA
CreateDirectoryA
SetEnvironmentVariableA
CompareStringW
lstrcpynA
CreateMutexA
InterlockedExchange
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
GetCurrentProcess
CreateFileA
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetConsoleScreenBufferInfo
CloseHandle
InterlockedDecrement
GetCPInfo
GetSystemTimeAsFileTime
MoveFileA
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
EncodePointer
SetConsoleCtrlHandler
InterlockedIncrement
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
FindFirstFileExA
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
WriteFile
GetModuleFileNameW
HeapCreate
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
LCMapStringW
MultiByteToWideChar
GetStringTypeW
Sleep
GetLocaleInfoW
SetHandleCount
DeleteCriticalSection
GetTimeZoneInformation
RtlUnwind
LoadLibraryW
GetConsoleCP
FlushFileBuffers
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapSize
WriteConsoleW
GetDriveTypeW
CreateFileW
SetEnvironmentVariableW
user32
CharToOemA
OemToCharA
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
Sections
.text Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 830KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14.0MB - Virtual size: 445B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ