Static task
static1
Behavioral task
behavioral1
Sample
2024-07-04_9c6ae8bc66679534f424e892ddfc3a5d_mafia.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-07-04_9c6ae8bc66679534f424e892ddfc3a5d_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-04_9c6ae8bc66679534f424e892ddfc3a5d_mafia
-
Size
1.9MB
-
MD5
9c6ae8bc66679534f424e892ddfc3a5d
-
SHA1
97f696d67bd4f2320b61ff9da860b437da914ed6
-
SHA256
8b8f4a34daec9ec8736d73ba4ef5c88d88183976914e53f20df32fd26c62626e
-
SHA512
df779ee0fc5f6536edd9ff38bb8063c2f87e07619cdfc2130714681de3de967692776dc8f7bcc13a2f0cd39a84d79a5ab326a7720e419e254f7480c1ca8b7115
-
SSDEEP
24576:mfR65qJN6zGQ+ESTDVnRkDTIwtVg9N9JMlDlfjRiVuVsWt5MJMs:mfR6w6aQ+EW/kDTNHgFIDRRAubt5M
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-04_9c6ae8bc66679534f424e892ddfc3a5d_mafia
Files
-
2024-07-04_9c6ae8bc66679534f424e892ddfc3a5d_mafia.exe windows:5 windows x86 arch:x86
c018181792a460468216e987cb665180
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
IIDFromString
StringFromGUID2
shell32
SHGetFolderPathA
SHGetFolderPathW
user32
DispatchMessageW
DispatchMessageA
MsgWaitForMultipleObjectsEx
IsWindowUnicode
PeekMessageA
TranslateMessage
GetMessageW
GetMessageA
kernel32
GetLastError
FileTimeToSystemTime
LocalFree
LoadLibraryExW
WaitForSingleObject
OpenMutexA
GetNativeSystemInfo
GetCurrentProcess
GetModuleHandleExW
GetSystemDirectoryA
GetModuleFileNameA
GetTempPathA
CreateFileA
GetTickCount
GetFileAttributesA
SetLastError
RemoveDirectoryA
SetFileAttributesA
FindClose
CloseHandle
DeleteFileA
Sleep
FormatMessageW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
PeekNamedPipe
SetHandleInformation
SetDllDirectoryA
CreateProcessA
TerminateProcess
ReadFile
CreatePipe
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleExA
FindResourceA
LoadResource
SizeofResource
LockResource
FreeLibrary
LoadLibraryW
GetProcAddress
InterlockedDecrement
CreateFileW
SetFilePointerEx
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
DeleteCriticalSection
SetFilePointer
FlushFileBuffers
HeapSize
SetEndOfFile
GetProcessHeap
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoW
GetDriveTypeW
GetCurrentDirectoryW
GetFileInformationByHandle
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetTimeZoneInformation
CompareStringW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetFullPathNameW
CreateDirectoryW
GetConsoleMode
QueryPerformanceCounter
GetStartupInfoW
SetHandleCount
FindFirstFileExW
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStdHandle
ExitProcess
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
RtlUnwind
RaiseException
GetCPInfo
HeapReAlloc
HeapFree
GetCommandLineA
HeapSetInformation
GetSystemTimeAsFileTime
GetFileType
WriteFile
GetConsoleCP
HeapAlloc
advapi32
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
oleaut32
GetErrorInfo
SysFreeString
msi
ord91
ord117
ord141
ord168
ord189
ord158
ord115
ord159
ord67
ord31
ord137
ord160
ord8
ord44
ord204
version
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE