H:\iNodeCode\Lb_V7R3B05D133_PC_r24349\inodemgr\Build\ReleasePdb\DAMSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-03_49e571199198ed1a714a11c3e5d65933_mafia.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-07-03_49e571199198ed1a714a11c3e5d65933_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-07-03_49e571199198ed1a714a11c3e5d65933_mafia
-
Size
10.4MB
-
MD5
49e571199198ed1a714a11c3e5d65933
-
SHA1
194a13c949651afd849b5e1966d346381bd6474e
-
SHA256
6a6293438ad9ac50b0b6fda77cfb30d8d98b655ffe101029c9473e5da13c752e
-
SHA512
f109df4b76bbb336194bb097a45804cdb19687d78baae6c42a84ce680fa7bb8ea8cac6acaf109336ab17520d831b259d1c1ea8445852c2419dd5665ee20f06b4
-
SSDEEP
196608:A8jml72uvzKp7Ah13Jvo5Inzk7R4BdWuqokiZOiaTutfciG5djc892oz+h1lZw6G:3jmEuvz87Ah7voX7+BdWuqokiZOiaTu+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-03_49e571199198ed1a714a11c3e5d65933_mafia
Files
-
2024-07-03_49e571199198ed1a714a11c3e5d65933_mafia.exe windows:5 windows x86 arch:x86
18629a7a227fe7ad84e02e17f6265e5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
ReadFile
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentProcess
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
LocalAlloc
SetFileAttributesA
GetFileAttributesA
RemoveDirectoryA
GetTickCount
GetFileAttributesExA
CreateProcessA
GetStartupInfoA
CreatePipe
WriteConsoleW
SetStdHandle
FormatMessageA
lstrlenA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
OpenMutexA
CreateEventA
SetEvent
DeleteFileA
GetModuleFileNameA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetPrivateProfileIntA
LoadLibraryExA
GetProcAddress
Sleep
CreateDirectoryA
GetLocalTime
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
GetCurrentThreadId
CloseHandle
LocalFree
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
MoveFileExA
LoadLibraryW
FreeLibrary
GetExitCodeProcess
GetConsoleMode
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetConsoleCP
user32
ExitWindowsEx
advapi32
RegDeleteValueA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateGuid
Sections
.text Size: 288KB - Virtual size: 288KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ