Static task
static1
Behavioral task
behavioral1
Sample
2024-07-07_9249349a0eb3985eb3d2d87af3cbb4ee_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-07_9249349a0eb3985eb3d2d87af3cbb4ee_mafia.exe
Resource
win10v2004-20240704-en
General
-
Target
2024-07-07_9249349a0eb3985eb3d2d87af3cbb4ee_mafia
-
Size
1.7MB
-
MD5
9249349a0eb3985eb3d2d87af3cbb4ee
-
SHA1
1766760ee2a7dd295b9d3c4ffa15c8df053cf35a
-
SHA256
bd7e008e7912cfd23a8c4443f95205bdc07930ca67d59e8820418a5b2d379206
-
SHA512
677a00250957cec24aee7e0679529cc90fc19d003d7bc096901a6107ba9f089439f0655384dcefde6fac2ea309eb27ec668977fc362056f25fb693f9b3d553c5
-
SSDEEP
24576:gcZzJxNI8noxMsVYB7RKD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/dnoPyBNKLNiXicJFFRGNzj3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-07_9249349a0eb3985eb3d2d87af3cbb4ee_mafia
Files
-
2024-07-07_9249349a0eb3985eb3d2d87af3cbb4ee_mafia.exe windows:5 windows x86 arch:x86
eaa63af9f58f965949cc6e99d7f642d6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CLSIDFromString
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
shell32
ShellExecuteA
SHGetFolderPathA
Shell_NotifyIconA
wininet
InternetTimeToSystemTime
InternetCrackUrlA
InternetReadFile
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetErrorDlg
HttpQueryInfoA
InternetCloseHandle
InternetTimeFromSystemTime
crypt32
CryptProtectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData
kernel32
HeapCreate
GetModuleFileNameW
GetStdHandle
ExitProcess
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrlenA
lstrcmpA
CloseHandle
CreateMutexA
CreateEventA
WaitForSingleObject
lstrcatA
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
GetProcAddress
GetModuleHandleA
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
IsDBCSLeadByte
SystemTimeToTzSpecificLocalTime
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
WaitForMultipleObjects
GetCommandLineA
lstrcpyA
SetEvent
ResetEvent
CreateThread
lstrcpynA
OpenEventA
WriteFile
CreateFileA
Sleep
ReadFile
GetCurrentProcess
GetVersionExA
LocalFree
GetTempPathA
GetTickCount
GetCurrentProcessId
DeleteFileA
FileTimeToSystemTime
SetDllDirectoryA
GetLocaleInfoA
LoadLibraryA
GetSystemDirectoryA
GetCurrentThreadId
GetLocalTime
FormatMessageW
SetHandleInformation
CreatePipe
GetExitCodeProcess
PeekNamedPipe
CreateProcessA
GetNativeSystemInfo
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetThreadLocale
LoadLibraryW
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoW
GetStringTypeW
IsProcessorFeaturePresent
GetTimeZoneInformation
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
GetDateFormatA
GetTimeFormatA
LCMapStringW
GetCPInfo
GetFileType
GetConsoleMode
GetConsoleCP
GetStartupInfoW
HeapSetInformation
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapFree
HeapAlloc
RtlUnwind
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
SetHandleCount
FlushFileBuffers
SetFilePointer
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CreateFileW
TerminateProcess
SetEnvironmentVariableA
SetLastError
user32
MessageBoxA
RegisterClassA
CreateWindowExA
ShowWindow
SetWindowLongA
DestroyWindow
DefWindowProcA
PostQuitMessage
CreatePopupMenu
AppendMenuA
GetCursorPos
SetForegroundWindow
TrackPopupMenu
PostMessageA
GetSystemMetrics
LoadImageA
LoadStringA
MsgWaitForMultipleObjectsEx
PeekMessageA
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
CharNextA
wsprintfA
GetDesktopWindow
GetWindowLongA
advapi32
RegQueryInfoKeyW
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegNotifyChangeKeyValue
RegEnumKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegEnumKeyA
RegSetValueExA
oleaut32
VarUI4FromStr
gdi32
GetStockObject
Sections
.text Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.2MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE