Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_388ec73261f91d75c294caf886b4542a_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-07_388ec73261f91d75c294caf886b4542a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_388ec73261f91d75c294caf886b4542a_mafia
-
Size
304KB
-
MD5
388ec73261f91d75c294caf886b4542a
-
SHA1
a10574912d5f94164845f2f8652702694a2b13d9
-
SHA256
cd33b151f8ac1ee5ce62c45cb2fc5d7f1c9f7b9f434305be82312e66425bf7ec
-
SHA512
7df5eec3c86eb8e56e215f392c786bd52c4998afdefbe341f089a63e37952e8e5cdd7c08a98cfb72674be5e77b4d6ee7b23263018c3a47e0b510e8eb4e65414a
-
SSDEEP
6144:4Id3pxFmV/FfxzzyCN38dW20mh6XMZ9WL:vZ/Q/Ff9z0dxa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-07_388ec73261f91d75c294caf886b4542a_mafia
Files
-
2024-08-07_388ec73261f91d75c294caf886b4542a_mafia.exe windows:5 windows x86 arch:x86
c60b4d9c7000b1bc1dde5de5194ea962
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
GetVolumeInformationA
VirtualProtectEx
GetCurrentProcess
lstrcpyA
GetLocalTime
GetLastError
lstrlenA
SetLastError
WaitForSingleObject
CreateThread
lstrcmpiA
Sleep
GetModuleFileNameW
RaiseException
InitializeCriticalSectionAndSpinCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitProcess
TerminateProcess
GetModuleHandleW
InterlockedIncrement
lstrcmpiW
LocalFree
GetCommandLineW
LoadLibraryExW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetModuleHandleExW
GetTickCount
GetUserDefaultUILanguage
FindClose
FindFirstFileW
SetEndOfFile
SetStdHandle
WriteConsoleW
LoadLibraryW
VirtualQuery
lstrlenW
InterlockedDecrement
GetModuleFileNameA
CreateFileW
GetFileSize
CloseHandle
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
WriteFile
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
WideCharToMultiByte
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
user32
CallWindowProcW
wsprintfA
DestroyWindow
CharNextW
DefWindowProcW
wsprintfW
FindWindowW
GetWindowThreadProcessId
advapi32
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
shell32
CommandLineToArgvW
ShellExecuteW
ole32
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
OleUninitialize
CLSIDFromString
CoUninitialize
CoInitialize
CLSIDFromProgID
CoCreateInstance
OleRun
CoTaskMemFree
oleaut32
GetErrorInfo
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VarUI4FromStr
shlwapi
SHSetValueA
SHDeleteKeyA
PathFileExistsW
PathRemoveFileSpecA
PathAddBackslashA
SHGetValueA
PathStripPathA
SHGetValueW
comctl32
InitCommonControlsEx
psapi
GetModuleFileNameExA
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSAStartup
gethostname
WSACleanup
gethostbyname
dbghelp
MiniDumpWriteDump
wininet
HttpSendRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetCreateUrlA
HttpOpenRequestA
HttpQueryInfoA
InternetCrackUrlA
InternetOpenA
libcurl
curl_global_cleanup
curl_global_init
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ