Static task
static1
Behavioral task
behavioral1
Sample
2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia
-
Size
10.8MB
-
MD5
a712770ab4dd9d92f91603ca8c6d6a15
-
SHA1
e22c98c9442ced02cd30838345111269abe47343
-
SHA256
58a3dc39f0d2c0e812bed7d40e67cb784d778aad1f55fd5dc14ad2280c30b02d
-
SHA512
5132db28491d14388fc4481caad34361e8f57f2faffb315a953c8e5696bd0172a32672abf492d645c2f4c0de3c54c6510667fe173e1feffbe5c39d70a859ce88
-
SSDEEP
49152:3Vdrl/8HAzGCbGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGv:3Vdrl/9zG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia
Files
-
2024-11-06_a712770ab4dd9d92f91603ca8c6d6a15_mafia.exe windows:5 windows x86 arch:x86
6f11f306c6f768b1acf4ae71c3f1ecc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemPowerStatus
lstrcpynW
WritePrivateProfileStructW
GetVolumePathNamesForVolumeNameW
VerifyVersionInfoA
WritePrivateProfileSectionW
IsBadWritePtr
ReplaceFileW
GetModuleFileNameW
lstrlenW
DisconnectNamedPipe
GetProcAddress
GetLongPathNameA
PeekConsoleInputW
CopyFileA
EnumSystemCodePagesW
GlobalGetAtomNameA
SetFileAttributesA
BuildCommDCBW
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
TransmitCommChar
LockResource
SetFileApisToANSI
QueryDosDeviceW
GetThreadSelectorEntry
SetProcessWorkingSetSize
SetConsoleWindowInfo
AddAtomA
Module32FirstW
WaitForMultipleObjects
GlobalWire
FindNextFileA
WTSGetActiveConsoleSessionId
GetProcessAffinityMask
GetCPInfoExA
SetFileShortNameA
GetDiskFreeSpaceExW
WriteFileEx
GetWindowsDirectoryW
GetVolumeNameForVolumeMountPointW
MoveFileWithProgressW
GetThreadTimes
FindActCtxSectionStringW
SetFileAttributesW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
HeapReAlloc
GetStringTypeW
WriteFileGather
WriteFile
ClearCommBreak
GetNumberFormatA
OutputDebugStringW
FreeEnvironmentStringsA
GetCommProperties
GetSystemDefaultLCID
FindFirstFileExW
GlobalDeleteAtom
WriteConsoleInputA
ScrollConsoleScreenBufferW
ReadConsoleA
OpenJobObjectA
WriteTapemark
LoadLibraryExW
HeapAlloc
FindResourceW
GetCPInfo
lstrlenA
GlobalGetAtomNameW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
CloseHandle
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
Sleep
FatalAppExitA
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteConsoleW
LCMapStringW
IsValidLocale
user32
GetMonitorInfoA
CreatePopupMenu
GetMenuInfo
DispatchMessageW
SetProcessWindowStation
advapi32
AbortSystemShutdownA
GetSecurityDescriptorGroup
SetPrivateObjectSecurity
InitiateSystemShutdownW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
ClearEventLogA
RegReplaceKeyA
EnumServicesStatusW
RegDeleteValueW
GetAce
OpenBackupEventLogA
RegDeleteKeyW
RegOpenKeyW
RegQueryMultipleValuesW
OpenEventLogW
RegisterEventSourceW
RegSetValueA
CreateProcessAsUserA
DestroyPrivateObjectSecurity
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 92KB - Virtual size: 903KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10.6MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ