Static task
static1
Behavioral task
behavioral1
Sample
2024-11-06_f4c675ba77abd4b560b6927107f04d5a_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-06_f4c675ba77abd4b560b6927107f04d5a_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-06_f4c675ba77abd4b560b6927107f04d5a_mafia
-
Size
12.6MB
-
MD5
f4c675ba77abd4b560b6927107f04d5a
-
SHA1
a57a67dc9ed2228fb3b02f4289dd632f01f9a82b
-
SHA256
507aced06e7338e082a63b69fded2e8d40d92c9e15271d3f3ce9b4b564939c72
-
SHA512
2bb27a269086ed8facedf1daa08e3acfc1b181425c244a25c31dccea7ed85b90caaaf8df241a464b3adefd244aeb49db3f3b14db0adf347cb83b078a32a07e00
-
SSDEEP
49152:TVdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGX:TVdrl/9zG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-11-06_f4c675ba77abd4b560b6927107f04d5a_mafia
Files
-
2024-11-06_f4c675ba77abd4b560b6927107f04d5a_mafia.exe windows:5 windows x86 arch:x86
6f11f306c6f768b1acf4ae71c3f1ecc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemPowerStatus
lstrcpynW
WritePrivateProfileStructW
GetVolumePathNamesForVolumeNameW
VerifyVersionInfoA
WritePrivateProfileSectionW
IsBadWritePtr
ReplaceFileW
GetModuleFileNameW
lstrlenW
DisconnectNamedPipe
GetProcAddress
GetLongPathNameA
PeekConsoleInputW
CopyFileA
EnumSystemCodePagesW
GlobalGetAtomNameA
SetFileAttributesA
BuildCommDCBW
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
TransmitCommChar
LockResource
SetFileApisToANSI
QueryDosDeviceW
GetThreadSelectorEntry
SetProcessWorkingSetSize
SetConsoleWindowInfo
AddAtomA
Module32FirstW
WaitForMultipleObjects
GlobalWire
FindNextFileA
WTSGetActiveConsoleSessionId
GetProcessAffinityMask
GetCPInfoExA
SetFileShortNameA
GetDiskFreeSpaceExW
WriteFileEx
GetWindowsDirectoryW
GetVolumeNameForVolumeMountPointW
MoveFileWithProgressW
GetThreadTimes
FindActCtxSectionStringW
SetFileAttributesW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
HeapReAlloc
GetStringTypeW
WriteFileGather
WriteFile
ClearCommBreak
GetNumberFormatA
OutputDebugStringW
FreeEnvironmentStringsA
GetCommProperties
GetSystemDefaultLCID
FindFirstFileExW
GlobalDeleteAtom
WriteConsoleInputA
ScrollConsoleScreenBufferW
ReadConsoleA
OpenJobObjectA
WriteTapemark
LoadLibraryExW
HeapAlloc
FindResourceW
GetCPInfo
lstrlenA
GlobalGetAtomNameW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
CloseHandle
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
Sleep
FatalAppExitA
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteConsoleW
LCMapStringW
IsValidLocale
user32
GetMonitorInfoA
CreatePopupMenu
GetMenuInfo
DispatchMessageW
SetProcessWindowStation
advapi32
AbortSystemShutdownA
GetSecurityDescriptorGroup
SetPrivateObjectSecurity
InitiateSystemShutdownW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
ClearEventLogA
RegReplaceKeyA
EnumServicesStatusW
RegDeleteValueW
GetAce
OpenBackupEventLogA
RegDeleteKeyW
RegOpenKeyW
RegQueryMultipleValuesW
OpenEventLogW
RegisterEventSourceW
RegSetValueA
CreateProcessAsUserA
DestroyPrivateObjectSecurity
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 903KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12.3MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ