C:\b\build\slave\win\build\src\build\Release\delegate_execute.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-27_16889661108f12b00191f89d2d0c04ed_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-27_16889661108f12b00191f89d2d0c04ed_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-27_16889661108f12b00191f89d2d0c04ed_mafia
-
Size
1.4MB
-
MD5
16889661108f12b00191f89d2d0c04ed
-
SHA1
e107a2371ea379e1edc3cbd7efc21a7b1922c155
-
SHA256
f34b0e8f1653fc5b69e020559e76c1942bfdf7a6961c11f5cc53149147d1b46e
-
SHA512
7f6f39781e1f1d8a5e0c012f79eeff25ee62b589e8b84be793222164afffa6209637092f5ba17edf0d2a7e1fd9fcbbe65504b4e794b9f775d8540e7d1fa48991
-
SSDEEP
24576:sDjbzXLotdvzDOVWGS9eKwJ05mNFHgEN6Ptqo/CiEhhZrDtnPtuokRwskxPNEN:svIJzDOVWb9el05mfHILkh1ZWK6N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-07-27_16889661108f12b00191f89d2d0c04ed_mafia
Files
-
2024-07-27_16889661108f12b00191f89d2d0c04ed_mafia.exe windows:5 windows x86 arch:x86
3e9529ecf713feddb57ecd1858776858
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
wininet
InternetCrackUrlW
kernel32
OpenEventW
GetCurrentProcessId
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetStdHandle
GetUserDefaultUILanguage
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
OpenMutexW
SetEvent
CreateEventW
CreateThread
GetCurrentThreadId
Sleep
WaitForSingleObject
OpenProcess
CreateProcessW
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
GetThreadLocale
LockResource
WTSGetActiveConsoleSessionId
InterlockedDecrement
InterlockedIncrement
CloseHandle
lstrcmpiW
WriteConsoleW
GetTimeZoneInformation
LoadLibraryW
GetStringTypeW
GetFileType
SetHandleCount
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
CreateFileA
DuplicateHandle
SetEnvironmentVariableA
CompareStringW
LocalAlloc
LocalFree
InterlockedExchange
LoadLibraryA
IsDebuggerPresent
GetCurrentProcess
ExpandEnvironmentStringsW
MapViewOfFile
UnmapViewOfFile
CreateDirectoryW
WriteFile
GetFileAttributesW
ReadFile
CreateFileW
GetTempPathW
GetCurrentDirectoryW
SetLastError
CreateFileMappingW
GetFileTime
SetUnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
AssignProcessToJobObject
GetExitCodeProcess
TerminateProcess
GetStdHandle
HeapSetInformation
GetEnvironmentStringsW
ResumeThread
InterlockedCompareExchange
CreateMutexW
SetFilePointer
FormatMessageA
GetModuleHandleA
ReleaseMutex
GetNativeSystemInfo
GetVersionExW
SetEndOfFile
FlushFileBuffers
QueryPerformanceCounter
GetSystemDirectoryW
GetWindowsDirectoryW
InterlockedExchangeAdd
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
WideCharToMultiByte
EncodePointer
DecodePointer
InitializeCriticalSection
UnhandledExceptionFilter
HeapAlloc
HeapFree
GetStartupInfoW
ExitProcess
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetProcessHeap
RtlUnwind
GetCPInfo
LCMapStringW
IsProcessorFeaturePresent
HeapCreate
GetLocaleInfoW
HeapSize
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
user32
MessageBoxW
CharNextW
AllowSetForegroundWindow
IsImmersiveProcess
GetSystemMetrics
PostThreadMessageW
GetWindowThreadProcessId
FindWindowExW
CharUpperW
DispatchMessageW
TranslateMessage
GetMessageW
advapi32
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
GetSidSubAuthority
GetSidSubAuthorityCount
CreateProcessAsUserW
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetFileSecurityW
SetSecurityDescriptorDacl
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
InitializeSecurityDescriptor
RegQueryValueExW
ole32
CoTaskMemAlloc
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoUninitialize
CoTaskMemFree
CoRegisterClassObject
oleaut32
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
VarUI4FromStr
SysFreeString
VariantClear
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
winmm
timeGetTime
wtsapi32
WTSQueryUserToken
Sections
.text Size: 516KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE