c:\bld_area\SEP_12.1\Output\Install\Bin.iru\setiCollect.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-09_7e541195e95161526978e4d60454465a_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-09_7e541195e95161526978e4d60454465a_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-09_7e541195e95161526978e4d60454465a_mafia
-
Size
1.8MB
-
MD5
7e541195e95161526978e4d60454465a
-
SHA1
bb9f283fcf11941fc9515e61e08fecb943b65352
-
SHA256
df141c647c0e23db64c5c1b7e37ce9343e77d4329e0f7d0a39489f4086ff89f1
-
SHA512
a5a9b4cf2664ee54b808e24d9f7c7baaede9c35a5329d3beb519a4942dcd424291b80fd93cfb25c0ba939fdd9b8967ddea92de37374d80bdcb8633a04c5b4ff0
-
SSDEEP
49152:wPn+7b+x9GgHF7l/B+GSvJHg0/hgyfo7s6hc:wPnOb+Hz+jJGy+Tc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-09_7e541195e95161526978e4d60454465a_mafia
Files
-
2024-07-09_7e541195e95161526978e4d60454465a_mafia.exe windows:5 windows x86 arch:x86
6c8400605dc41fcf8d1147e523dc8f28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetLogicalDriveStringsW
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
LoadLibraryExW
GetModuleHandleW
FindFirstFileW
GetSystemDirectoryW
FindNextFileW
GetCurrentProcess
InterlockedDecrement
GetFullPathNameA
LocalAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
VerifyVersionInfoW
VerSetConditionMask
GetCurrentThread
GetModuleFileNameW
VirtualFree
VirtualAlloc
GetWindowsDirectoryW
GetCurrentDirectoryW
GetShortPathNameW
GetLongPathNameW
TryEnterCriticalSection
lstrlenA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
OpenProcess
DuplicateHandle
ReleaseSemaphore
CreateSemaphoreW
OpenSemaphoreW
SetEvent
PulseEvent
ResetEvent
CreateEventW
OpenEventW
WaitForMultipleObjects
WaitForMultipleObjectsEx
GetModuleHandleA
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetTimeZoneInformation
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
CompareStringW
GetDateFormatA
GetTimeFormatA
LCMapStringW
GetCPInfo
RtlUnwind
lstrlenW
GetFullPathNameW
InterlockedExchange
RaiseException
InterlockedIncrement
GetStringTypeW
GetLocaleInfoW
GetCommandLineW
HeapSetInformation
user32
PeekMessageW
DispatchMessageW
GetMessageA
IsWindowUnicode
DispatchMessageA
TranslateMessage
GetMessageW
MsgWaitForMultipleObjectsEx
GetSystemMetrics
ole32
CoInitializeEx
OleSaveToStream
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
IIDFromString
OleLoadFromStream
CreateStreamOnHGlobal
CoUninitialize
StringFromGUID2
CLSIDFromString
GetHGlobalFromStream
oleaut32
SafeArrayCreate
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnlock
SafeArrayRedim
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VariantCopyInd
SysFreeString
SysAllocString
iphlpapi
GetAdaptersAddresses
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 632KB - Virtual size: 636KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE