K:\src\kkvsvr\Release\kkvsvr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_625b350eea45b944596a829a1f856018_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-03_625b350eea45b944596a829a1f856018_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_625b350eea45b944596a829a1f856018_mafia
-
Size
871KB
-
MD5
625b350eea45b944596a829a1f856018
-
SHA1
c35f2ffb05daeea1fb87d88cb508f3474867cde9
-
SHA256
3b66e1c441f97c2fed5fdd54f117f568c6ae3cb82b1814444c26ab171f1d99bc
-
SHA512
3b44ca3013d2bf34d473f2eaf2491374ec118722e210dd0f4c0037bec965cb3cffcf9a6061f7da8bed2cfbfed8fc0ce789283c05370fe23156f49bf44fb4017a
-
SSDEEP
24576:bEwDhEjfbDtpUcNcSe3EHQ/XT/UUfei27:bdGfbDtpeU0T/Dfu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-03_625b350eea45b944596a829a1f856018_mafia
Files
-
2024-09-03_625b350eea45b944596a829a1f856018_mafia.exe windows:5 windows x86 arch:x86
f9ff7fdb1956fa21df8d611b6d73e2c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ws2_32
send
gethostbyname
inet_addr
ntohs
getsockname
bind
listen
accept
WSAStartup
WSAAddressToStringA
ioctlsocket
connect
select
WSAGetLastError
htons
setsockopt
recv
socket
closesocket
kernel32
ResetEvent
GetSystemInfo
CreateEventA
DeviceIoControl
CancelIo
UnmapViewOfFile
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
GetModuleHandleA
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
FreeLibrary
GetSystemDirectoryA
GetLastError
GetProcAddress
LoadLibraryA
DeleteFileA
CreateFileA
GetCurrentProcess
lstrcatA
RaiseException
GetCurrentThreadId
OutputDebugStringA
lstrcpyA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
OpenProcess
GetTickCount
FindResourceExW
FindResourceW
LoadResource
SizeofResource
LockResource
CreateThread
GetEnvironmentVariableA
SetUnhandledExceptionFilter
OpenMutexA
CreateMutexA
GetOverlappedResult
WaitForMultipleObjects
SetEvent
GetProcessHeap
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
WriteConsoleW
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetLocaleInfoW
LoadLibraryW
InterlockedExchange
LCMapStringW
GetTimeZoneInformation
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetStdHandle
HeapDestroy
HeapCreate
GlobalFindAtomA
GlobalAddAtomA
CreateFileW
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
WriteFile
FindResourceA
FreeResource
GetModuleHandleW
GetNativeSystemInfo
GetVersion
QueryPerformanceCounter
GetModuleFileNameW
HeapFree
HeapAlloc
ExitThread
ResumeThread
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
HeapReAlloc
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetConsoleCP
GetConsoleMode
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
user32
GetWindowTextA
SendMessageTimeoutW
MessageBoxA
RegisterWindowMessageA
IsWindowVisible
EnumWindows
shell32
ShellExecuteA
ole32
OleInitialize
shlwapi
SHGetValueA
SHSetValueA
psapi
GetModuleFileNameExA
wininet
InternetReadFile
HttpQueryInfoW
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
dbghelp
MiniDumpWriteDump
netapi32
Netbios
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
advapi32
CreateServiceA
RegOpenKeyExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenSCManagerA
RegCloseKey
OpenServiceA
StartServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
Sections
.text Size: 535KB - Virtual size: 534KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ