E:\Chromiumsln\chromium\src\build\Release\chrome.exe.pdb
Behavioral task
behavioral1
Sample
2024-10-14_90c0c56788822ce8d76c6a7d9e9af6ae_mafia.exe
Resource
win7-20240903-en
General
-
Target
2024-10-14_90c0c56788822ce8d76c6a7d9e9af6ae_mafia
-
Size
905KB
-
MD5
90c0c56788822ce8d76c6a7d9e9af6ae
-
SHA1
ec7fcebab57dfe9ef7c17f84afe46aa0e3d30a1d
-
SHA256
6c51a02d87757732bcc6b7c9f596b63831775126b5c38cc746adfd9b559d9c23
-
SHA512
e371e92a8feef2b6eae4cef55d064ccbfcce01991e491425e4a3c680ce31b857ae5eb5891b6a9096b3fb0e7593b1d509a41a3dbe4ee56e36ac9245c1744d006b
-
SSDEEP
12288:QroNJyEwaFRDyXxdGqLXIs1aNBxpVIb00dF2Y/vpUc+HlOwvDywTphapFw1An1ve:QrobWGYb/B0FOwvDy43+2GA0r6Wla
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-14_90c0c56788822ce8d76c6a7d9e9af6ae_mafia
Files
-
2024-10-14_90c0c56788822ce8d76c6a7d9e9af6ae_mafia.exe windows:5 windows x86 arch:x86
a7456fb17865d8391de6b21352583b1c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
kernel32
CreateDirectoryW
GetTempPathW
GetLastError
CreateProcessW
CloseHandle
GetModuleHandleW
VirtualProtect
VirtualAllocEx
VirtualFreeEx
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
DuplicateHandle
GetExitCodeProcess
WaitForSingleObject
SizeofResource
LockResource
LoadResource
FindResourceW
VirtualFree
SetFilePointer
ReadFile
GetSystemInfo
VirtualAlloc
CreateFileW
GetUserDefaultLangID
CreateMutexW
GetTickCount
WriteFile
SetLastError
ReleaseMutex
GetCurrentProcessId
CreateEventW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
lstrlenW
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetCurrentThreadId
GetNativeSystemInfo
GetVersionExW
SetInformationJobObject
SetHandleInformation
VirtualQueryEx
OpenProcess
AssignProcessToJobObject
GetStdHandle
GetProcessId
HeapSetInformation
ResumeThread
MapViewOfFile
InterlockedCompareExchange
GetFileAttributesW
GetCurrentDirectoryW
GetLongPathNameW
CreateFileMappingW
QueryDosDeviceW
GetLocaleInfoW
GetUserDefaultUILanguage
CreateThread
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedExchangeAdd
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
SetEvent
ResetEvent
WaitForMultipleObjects
Sleep
GetSystemDirectoryW
GetWindowsDirectoryW
SetEndOfFile
FlushFileBuffers
RegisterWaitForSingleObject
UnregisterWaitEx
GetModuleHandleExW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
InterlockedIncrement
ReleaseSemaphore
InterlockedDecrement
RtlCaptureContext
CreateSemaphoreW
InitializeCriticalSection
GetThreadContext
SuspendThread
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
WriteProcessMemory
VirtualProtectEx
TerminateJobObject
SignalObjectAndWait
GetProcessHandleCount
GetFileType
CreateJobObjectW
CreateNamedPipeW
OpenEventW
SearchPathW
DebugBreak
ReadProcessMemory
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
EncodePointer
DecodePointer
UnhandledExceptionFilter
HeapFree
ExitProcess
GetStartupInfoW
GetConsoleCP
GetConsoleMode
HeapReAlloc
GetFullPathNameW
HeapAlloc
GetProcessHeap
SetStdHandle
RtlUnwind
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapSize
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
WriteConsoleW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetDriveTypeW
CompareStringW
CreateRemoteThread
GetModuleHandleA
FormatMessageW
LocalFree
GetModuleFileNameW
GetEnvironmentVariableW
SetCurrentDirectoryW
LoadLibraryExW
GetEnvironmentVariableA
GetCommandLineW
SetEnvironmentVariableA
LoadLibraryW
GetProcAddress
RtlCaptureStackBackTrace
user32
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
CloseWindowStation
wsprintfW
MessageBoxW
GetUserObjectInformationW
CharUpperW
userenv
GetProfileType
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
winmm
timeGetTime
advapi32
GetLengthSid
SetTokenInformation
RevertToSelf
RegDisablePredefinedCache
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
CreateProcessAsUserW
GetTraceEnableFlags
GetTraceLoggerHandle
ConvertStringSidToSidW
TraceEvent
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
SetThreadToken
CreateRestrictedToken
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
EqualSid
DuplicateToken
DuplicateTokenEx
Exports
Exports
CrashForException
DumpProcess
DumpProcessWithoutCrash
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
SetActiveURL
SetClientId
SetCommandLine2
SetCrashKeyValuePair
SetExperimentList3
SetExtensionID
SetGpuInfo
SetNumberOfExtensions
SetNumberOfViews
SetPrinterInfo
Sections
.text Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX Size: 238KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE