K:\src\kkvsvr\Release\kkvsvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_9146818836ed3d8298666dc2c975dad9_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-03_9146818836ed3d8298666dc2c975dad9_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_9146818836ed3d8298666dc2c975dad9_mafia
-
Size
874KB
-
MD5
9146818836ed3d8298666dc2c975dad9
-
SHA1
6ca9b1ea229a3c43ee32bffb8ae7e37fe2098783
-
SHA256
7084b91dbb4a783839ae28e6dbb49b082a0413591635af660ff99c3909ac6a68
-
SHA512
94b22a1312a4bb7e73c162340806f4bf067e01276843db058151a8cd5b7e41e819b7605ccf4ed179394de9050cb38e55ed7e6deea00dcf8da683803c3966d4fc
-
SSDEEP
24576:huPnUfb2Nzp+16+LpgDeMDND4TsJUf1RX+P5:h6UfbqV2WD9J4TsWfuP5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-03_9146818836ed3d8298666dc2c975dad9_mafia
Files
-
2024-09-03_9146818836ed3d8298666dc2c975dad9_mafia.exe windows:5 windows x86 arch:x86
f9ff7fdb1956fa21df8d611b6d73e2c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
send
gethostbyname
inet_addr
ntohs
getsockname
bind
listen
accept
WSAStartup
WSAAddressToStringA
ioctlsocket
connect
select
WSAGetLastError
htons
setsockopt
recv
socket
closesocket
kernel32
ResetEvent
GetSystemInfo
CreateEventA
DeviceIoControl
CancelIo
UnmapViewOfFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
DeleteFileA
CreateFileA
GetCurrentProcess
lstrcatA
RaiseException
GetCurrentThreadId
OutputDebugStringA
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess
GetTickCount
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
CreateThread
GetEnvironmentVariableA
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
GetOverlappedResult
WaitForMultipleObjects
SetEvent
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
LCMapStringW
GetTimeZoneInformation
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
HeapDestroy
HeapCreate
GlobalFindAtomA
GlobalAddAtomA
CreateFileW
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
WriteFile
FindResourceA
FreeResource
GetModuleHandleW
GetNativeSystemInfo
GetVersion
QueryPerformanceCounter
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
user32
GetWindowTextA
SendMessageTimeoutW
MessageBoxA
RegisterWindowMessageA
IsWindowVisible
EnumWindows
shell32
ShellExecuteA
ole32
OleInitialize
shlwapi
SHGetValueA
SHSetValueA
psapi
GetModuleFileNameExA
wininet
InternetReadFile
HttpQueryInfoW
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
dbghelp
MiniDumpWriteDump
netapi32
Netbios
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
CreateServiceA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
RegCloseKey
OpenServiceA
StartServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
Sections
.text Size: 535KB - Virtual size: 534KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ