K:\src\kkvsvr\Release\kkvsvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_2f68d7ee30b2c5fa1394527956ea9050_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-09-01_2f68d7ee30b2c5fa1394527956ea9050_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_2f68d7ee30b2c5fa1394527956ea9050_mafia
-
Size
868KB
-
MD5
2f68d7ee30b2c5fa1394527956ea9050
-
SHA1
19445bb20dc0209aa004c1ac38e3ab34fd626dca
-
SHA256
da426d60861d47301ab174d2b69e05244546e472ab11162a62e090cdee095ea3
-
SHA512
fee64ff1232cb2cf6935a0c79828d84b6078a8df9813a03391d236e4378a4c9d4a64501919b094ae84d0e5ecdfc8dbc25d33e3516d4fcc4bfb8ef6e048ab6b88
-
SSDEEP
12288:9KLzll1QQUTEagBDnkT4yTpkr95bGgnJjF/btRcCAUcFcNYsQmsoZwqgZiQHndIH:cH1QvKosJBbt1k8fZFgZi1T0AWe2lu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-01_2f68d7ee30b2c5fa1394527956ea9050_mafia
Files
-
2024-09-01_2f68d7ee30b2c5fa1394527956ea9050_mafia.exe windows:5 windows x86 arch:x86
f536615bd78d3766bdeee84650f86c23
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
send
gethostbyname
inet_addr
ntohs
getsockname
bind
listen
accept
WSAStartup
WSAAddressToStringA
ioctlsocket
connect
select
WSAGetLastError
htons
setsockopt
recv
socket
closesocket
kernel32
CreateFileW
ResetEvent
GetSystemInfo
CreateEventA
DeviceIoControl
CancelIo
UnmapViewOfFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
DeleteFileA
CreateFileA
GetCurrentProcess
lstrcatA
RaiseException
GetCurrentThreadId
OutputDebugStringA
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess
GetTickCount
CreateThread
GetEnvironmentVariableA
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
GetOverlappedResult
WaitForMultipleObjects
SetEvent
FindResourceExW
FindResourceW
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
LCMapStringW
GetTimeZoneInformation
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
GlobalFindAtomA
GlobalAddAtomA
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
WriteFile
FindResourceA
LoadResource
FreeResource
SizeofResource
LockResource
GetModuleHandleW
GetNativeSystemInfo
GetVersion
QueryPerformanceCounter
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
user32
GetWindowTextA
SendMessageTimeoutW
MessageBoxA
RegisterWindowMessageA
IsWindowVisible
EnumWindows
shell32
ShellExecuteA
ole32
OleInitialize
shlwapi
SHGetValueA
SHSetValueA
psapi
GetModuleFileNameExA
wininet
InternetReadFile
InternetOpenUrlA
HttpQueryInfoW
InternetOpenA
InternetCloseHandle
dbghelp
MiniDumpWriteDump
netapi32
Netbios
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
CreateServiceA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
RegCloseKey
OpenServiceA
StartServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
Sections
.text Size: 534KB - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ