Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_e359b9868e048aecaf28039e8d39cf95_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_e359b9868e048aecaf28039e8d39cf95_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_e359b9868e048aecaf28039e8d39cf95_mafia
-
Size
291KB
-
MD5
e359b9868e048aecaf28039e8d39cf95
-
SHA1
df3971229e444183d78394966c4da4a286d19382
-
SHA256
faae2d92b4d36295140345b9492af2c3a27b4c5382de3e763b64372b02e29b73
-
SHA512
5c27fce1ecb7224c7ce69fe0a29a7baeae1357b641db913611339428051b6af3871e370c5971ff9012c84b89d5859f578797660548dd0749daac044319bf21eb
-
SSDEEP
6144:X80ryPmuzOpnGroxsblkh/iqi04tzBhixTBlS7GWFZ:X80rtbnsnblkh6nvtzBhixTXS7RZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-13_e359b9868e048aecaf28039e8d39cf95_mafia
Files
-
2024-10-13_e359b9868e048aecaf28039e8d39cf95_mafia.exe windows:5 windows x86 arch:x86
345b9f3fdfc6dadb2d01f36dd766d583
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
ReadFile
GetDriveTypeW
FindFirstFileW
FindClose
GetTickCount
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
DeleteFileW
MoveFileW
MoveFileExW
GetCurrentProcess
GetNativeSystemInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
CreateProcessW
GetExitCodeProcess
WTSGetActiveConsoleSessionId
SetFilePointer
LoadLibraryW
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
CreateFileA
lstrlenW
DeleteFileA
GetLocalTime
OutputDebugStringA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
GetProcessHeap
SetEndOfFile
CreateFileW
GetLastError
WriteProcessMemory
LocalFree
CloseHandle
GetModuleFileNameA
GetExitCodeThread
LoadLibraryA
VirtualAllocEx
GetProcAddress
VirtualFreeEx
FreeLibrary
OpenProcess
CreateRemoteThread
GetModuleHandleW
OutputDebugStringW
WaitForSingleObject
GetModuleFileNameW
SetStdHandle
WriteConsoleW
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
HeapCreate
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
Sleep
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
user32
wsprintfW
shell32
CommandLineToArgvW
SHFileOperationW
SHGetFolderLocation
SHGetPathFromIDListW
ord155
shlwapi
PathFileExistsW
wtsapi32
WTSQueryUserToken
Sections
.text Size: 195KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ