C:\Users\woajh\Desktop\repos\PHY\Release\PHY.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-29_d4b0fb5ab766d83f1a2da0d88b89b8e0_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-29_d4b0fb5ab766d83f1a2da0d88b89b8e0_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-29_d4b0fb5ab766d83f1a2da0d88b89b8e0_mafia
-
Size
327KB
-
MD5
d4b0fb5ab766d83f1a2da0d88b89b8e0
-
SHA1
7d59496ba42b87000e5823baab963bae6dc29643
-
SHA256
a16b16feeaa94c0635c5badb0c0d5b54739a6a3e36f7f1f1e2eed6340faedfb5
-
SHA512
039cfef2b277c0a12f34da0f87bf6c7d0e8dba5eb9bf5d1edad01c5669dddaa4847607f43a903e611968a1089ce420129d2d9b2b6de39a383a9a128081402654
-
SSDEEP
6144:UfvNp9enEgqIitXrZHhVAMcuiMZa0geiFDrgVVVC+8UIv:UFeEg8tXrZBVATuiMU0g5F/gV/fIv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-08-29_d4b0fb5ab766d83f1a2da0d88b89b8e0_mafia
Files
-
2024-08-29_d4b0fb5ab766d83f1a2da0d88b89b8e0_mafia.exe windows:5 windows x86 arch:x86
a65171545af04b763bc9ba539851288c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
GetProcAddress
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetModuleFileNameA
FindFirstFileW
FindNextFileW
WriteFile
RemoveDirectoryW
SetFilePointer
FindClose
LocalAlloc
CreateFileW
GetLastError
GetWindowsDirectoryW
DeleteFileW
LoadLibraryW
CreateThread
LocalFree
ExitProcess
FreeLibrary
CopyFileW
lstrcpyW
lstrcmpW
GetSystemDirectoryW
GetModuleHandleA
GetStartupInfoW
IsDebuggerPresent
HeapAlloc
CloseHandle
OpenProcess
GetModuleFileNameW
GetCurrentProcess
GetCommandLineW
lstrcatW
HeapFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
SetEntriesInAclW
SetNamedSecurityInfoW
FreeSid
OpenProcessToken
GetTokenInformation
LookupPrivilegeValueW
shell32
ShellExecuteExA
SHGetSpecialFolderPathW
ole32
CoGetObject
CoUninitialize
CoInitializeEx
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcp140
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_BADOFF@std@@3_JB
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
_CxxThrowException
memset
_except_handler4_common
memmove
__CxxFrameHandler3
memcpy
api-ms-win-crt-string-l1-1-0
wcsncpy_s
_wcsicmp
wcscpy_s
wcscat_s
api-ms-win-crt-runtime-l1-1-0
terminate
_controlfp_s
_crt_atexit
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_set_app_type
_errno
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_register_onexit_function
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
_set_new_mode
free
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
fputc
fclose
fgetc
_get_stream_buffer_pointers
_fseeki64
fwrite
fsetpos
ungetc
setvbuf
fgetpos
fflush
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-time-l1-1-0
_time64
_localtime64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ