K:\src\kkvsvr\Release\kkvsvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_871e8cd86e95e56c269be18d8157aefe_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-01_871e8cd86e95e56c269be18d8157aefe_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_871e8cd86e95e56c269be18d8157aefe_mafia
-
Size
869KB
-
MD5
871e8cd86e95e56c269be18d8157aefe
-
SHA1
ed140a64cd81ce709016c0a8879c0aab65ba7148
-
SHA256
7a3402b43b933ebfcc49a4e001f4f2c302b52fc546fd2c37c79f48af4f261d32
-
SHA512
d001687139f7b79c4e128de615d80f5c4d404592f47ca8df5561bb032d316d8a9c04d11da5d856bc34cc6cc394bbd724f3135985bc35b548512919290e92490e
-
SSDEEP
12288:40Rw+h90EP9O5+701AIA4dNq4gST/bY2GhfMn28tEB48Xpua72cZnuuTHnGYTQUu:pp93psbY5fXbtP72cZnuu3TQkWenG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-01_871e8cd86e95e56c269be18d8157aefe_mafia
Files
-
2024-09-01_871e8cd86e95e56c269be18d8157aefe_mafia.exe windows:5 windows x86 arch:x86
46a8009f29acb3256316336e66e6132e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
send
gethostbyname
inet_addr
ntohs
getsockname
bind
listen
accept
WSAStartup
WSAAddressToStringA
ioctlsocket
connect
select
WSAGetLastError
htons
setsockopt
recv
socket
closesocket
kernel32
ResetEvent
GetSystemInfo
CreateEventA
DeviceIoControl
CancelIo
UnmapViewOfFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
DeleteFileA
CreateFileA
GetCurrentProcess
lstrcatA
RaiseException
GetCurrentThreadId
OutputDebugStringA
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess
GetTickCount
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
CreateThread
GetEnvironmentVariableA
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
GetOverlappedResult
WaitForMultipleObjects
SetEvent
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
LCMapStringW
GetTimeZoneInformation
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
HeapDestroy
HeapCreate
GlobalFindAtomA
GlobalAddAtomA
CreateFileW
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
WriteFile
FindResourceA
FreeResource
GetModuleHandleW
GetNativeSystemInfo
GetVersion
QueryPerformanceCounter
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
user32
GetWindowTextA
SendMessageTimeoutW
MessageBoxA
RegisterWindowMessageA
IsWindowVisible
EnumWindows
shell32
ShellExecuteA
ole32
OleInitialize
shlwapi
SHGetValueA
SHSetValueA
psapi
GetModuleFileNameExA
wininet
InternetReadFile
InternetOpenUrlA
HttpQueryInfoW
InternetOpenA
InternetCloseHandle
dbghelp
MiniDumpWriteDump
netapi32
Netbios
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
CreateServiceA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
RegCloseKey
OpenServiceA
StartServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
Sections
.text Size: 534KB - Virtual size: 533KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ