Static task
static1
Behavioral task
behavioral1
Sample
2024-11-04_9c51a91c066c0450f73e9094bff5b3d4_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-04_9c51a91c066c0450f73e9094bff5b3d4_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-04_9c51a91c066c0450f73e9094bff5b3d4_mafia
-
Size
13.8MB
-
MD5
9c51a91c066c0450f73e9094bff5b3d4
-
SHA1
69443b3cd6392afd4d9abd4191cc83979fbf1cf5
-
SHA256
1bbf4d3f017661eb57be195c6c53319731eb6c36aee2ddecf39b53ec91bcfdb2
-
SHA512
2eaabc50c4f270dbd8e9bb93221456fb1270ceda504b127765679eda4403c4c6efae4a18ed79fc1780acc885fd29b5e676479858a3a962a680941f0324fcca84
-
SSDEEP
49152:AVdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG3:AVdrl/9zG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-11-04_9c51a91c066c0450f73e9094bff5b3d4_mafia
Files
-
2024-11-04_9c51a91c066c0450f73e9094bff5b3d4_mafia.exe windows:5 windows x86 arch:x86
6f11f306c6f768b1acf4ae71c3f1ecc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemPowerStatus
lstrcpynW
WritePrivateProfileStructW
GetVolumePathNamesForVolumeNameW
VerifyVersionInfoA
WritePrivateProfileSectionW
IsBadWritePtr
ReplaceFileW
GetModuleFileNameW
lstrlenW
DisconnectNamedPipe
GetProcAddress
GetLongPathNameA
PeekConsoleInputW
CopyFileA
EnumSystemCodePagesW
GlobalGetAtomNameA
SetFileAttributesA
BuildCommDCBW
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
TransmitCommChar
LockResource
SetFileApisToANSI
QueryDosDeviceW
GetThreadSelectorEntry
SetProcessWorkingSetSize
SetConsoleWindowInfo
AddAtomA
Module32FirstW
WaitForMultipleObjects
GlobalWire
FindNextFileA
WTSGetActiveConsoleSessionId
GetProcessAffinityMask
GetCPInfoExA
SetFileShortNameA
GetDiskFreeSpaceExW
WriteFileEx
GetWindowsDirectoryW
GetVolumeNameForVolumeMountPointW
MoveFileWithProgressW
GetThreadTimes
FindActCtxSectionStringW
SetFileAttributesW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
HeapReAlloc
GetStringTypeW
WriteFileGather
WriteFile
ClearCommBreak
GetNumberFormatA
OutputDebugStringW
FreeEnvironmentStringsA
GetCommProperties
GetSystemDefaultLCID
FindFirstFileExW
GlobalDeleteAtom
WriteConsoleInputA
ScrollConsoleScreenBufferW
ReadConsoleA
OpenJobObjectA
WriteTapemark
LoadLibraryExW
HeapAlloc
FindResourceW
GetCPInfo
lstrlenA
GlobalGetAtomNameW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
CloseHandle
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
Sleep
FatalAppExitA
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteConsoleW
LCMapStringW
IsValidLocale
user32
GetMonitorInfoA
CreatePopupMenu
GetMenuInfo
DispatchMessageW
SetProcessWindowStation
advapi32
AbortSystemShutdownA
GetSecurityDescriptorGroup
SetPrivateObjectSecurity
InitiateSystemShutdownW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
ClearEventLogA
RegReplaceKeyA
EnumServicesStatusW
RegDeleteValueW
GetAce
OpenBackupEventLogA
RegDeleteKeyW
RegOpenKeyW
RegQueryMultipleValuesW
OpenEventLogW
RegisterEventSourceW
RegSetValueA
CreateProcessAsUserA
DestroyPrivateObjectSecurity
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 903KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13.5MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ