Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_e43bcc5e72e6ee29288018ee7df3fd43_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-10_e43bcc5e72e6ee29288018ee7df3fd43_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_e43bcc5e72e6ee29288018ee7df3fd43_mafia
-
Size
441KB
-
MD5
e43bcc5e72e6ee29288018ee7df3fd43
-
SHA1
baba1b3937c55cbdd56c8c1b13b05d5136c45764
-
SHA256
3963ace7413674e9f021c1f2adcd61ade7c8f0e19ac7e9ed89e66cf6796e462b
-
SHA512
2b391dd36f39f1c0651c4f2827b5c413788d1ccbc5bbd7ae36b14cdddf675d584d6ef88a7bceecf6a6047b221034bc2ead26218f3b5f94f8c362ee83be468c49
-
SSDEEP
12288:orud8GTkI/kTUr/6cYcUVxU4qFuHbhNWQR8s+opVzFbQTXSEJ:or1W/kYr/6cYc6sF6NWQRConlQTXP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-10_e43bcc5e72e6ee29288018ee7df3fd43_mafia
Files
-
2024-10-10_e43bcc5e72e6ee29288018ee7df3fd43_mafia.exe windows:5 windows x86 arch:x86
6151badc59a592a0020cc669ea0c95e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
GetDriveTypeW
FindFirstFileW
FindClose
CreateDirectoryW
GetTickCount
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
DeleteFileW
MoveFileW
MoveFileExW
GetCurrentProcess
GetNativeSystemInfo
GetVersionExW
CreateFileA
WTSGetActiveConsoleSessionId
lstrlenW
WideCharToMultiByte
DeleteFileA
GetLocalTime
OutputDebugStringA
CreateToolhelp32Snapshot
Process32FirstW
TerminateProcess
CreateProcessW
GetExitCodeProcess
GetModuleFileNameW
LoadLibraryW
GetCurrentProcessId
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
CreateEventW
SetEvent
InitializeCriticalSectionAndSpinCount
SetHandleCount
TlsAlloc
WriteFile
SetFilePointer
CreateFileW
GetLastError
WriteProcessMemory
LocalFree
CloseHandle
GetModuleFileNameA
GetExitCodeThread
LoadLibraryA
VirtualAllocEx
GetProcAddress
VirtualFreeEx
OpenProcess
CreateRemoteThread
GetModuleHandleW
OutputDebugStringW
WaitForSingleObject
lstrlenA
Process32NextW
GetEnvironmentStringsW
FreeLibrary
FreeEnvironmentStringsW
ExitProcess
HeapCreate
IsProcessorFeaturePresent
SetPriorityClass
DeviceIoControl
GetProcessHeap
SetEndOfFile
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
WriteConsoleW
GetFileType
GetStdHandle
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
user32
wsprintfW
MessageBoxA
advapi32
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
LookupAccountSidW
InitializeSecurityDescriptor
OpenProcessToken
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
shell32
SHGetPathFromIDListW
ord155
SHGetFolderLocation
SHFileOperationW
CommandLineToArgvW
ole32
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
shlwapi
PathFileExistsW
psapi
GetModuleFileNameExW
wtsapi32
WTSQueryUserToken
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
iphlpapi
GetAdaptersInfo
Sections
.text Size: 313KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ