Static task
static1
Behavioral task
behavioral1
Sample
2024-11-22_fcd522ea627ddb3d9a49a2c8b938ef6a_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-11-22_fcd522ea627ddb3d9a49a2c8b938ef6a_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-22_fcd522ea627ddb3d9a49a2c8b938ef6a_mafia
-
Size
323KB
-
MD5
fcd522ea627ddb3d9a49a2c8b938ef6a
-
SHA1
a6a7186701bdd088c0a0aa0d879121bcdd9f60c0
-
SHA256
6f88f48ff68b6d6c6f66e6af25bd0bcf0071d9b224a696f0119a7469d9036e66
-
SHA512
c96dc8672fbc1e668f08c7ae0462151a9637aa34e83fb9f9e639ce8001520523c7fbe9dcb3054173619fbaf1aa648d59b4576125b5703dcd575e22dba500bd51
-
SSDEEP
6144:aYqx+m2rmz45BWJZr+qPMbQ2XeyQBXqMZwhI1I5fWR26fGuA9Z5x:3qx+m2S4v8rfPIQ2dE1IAR299Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-11-22_fcd522ea627ddb3d9a49a2c8b938ef6a_mafia
Files
-
2024-11-22_fcd522ea627ddb3d9a49a2c8b938ef6a_mafia.exe windows:5 windows x86 arch:x86
1811a2fdbd9f053ec06ecb4cef2e9483
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtectEx
WriteProcessMemory
Process32Next
Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
SetConsoleWindowInfo
GetEnvironmentVariableA
GetCommConfig
CloseHandle
GetExitCodeProcess
WaitForSingleObject
lstrcatA
lstrcpyA
GetEnvironmentVariableW
GetModuleFileNameW
GetProcAddress
GetModuleHandleA
VirtualFreeEx
CreateRemoteThread
VirtualAllocEx
OpenProcess
GetVersion
GetFileSize
GetCompressedFileSizeA
GetFileAttributesA
CreateFileA
LoadLibraryA
GetLastError
GetCurrentProcess
ExitProcess
LocalFree
LocalSize
LocalAlloc
lstrlenA
FormatMessageA
VirtualFree
GetThreadContext
lstrcmpW
lstrcatW
lstrcpyW
GetSystemDirectoryW
GetSystemWow64DirectoryW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
ReadFile
lstrcmpiW
GetUserDefaultLCID
WriteConsoleW
SetEnvironmentVariableW
CompareStringW
HeapSize
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetModuleHandleW
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
MultiByteToWideChar
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
Sleep
FatalAppExitA
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
LCMapStringW
WriteFile
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RaiseException
GetStringTypeW
RtlUnwind
HeapReAlloc
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
SetStdHandle
CreateFileW
user32
MessageBoxA
CopyAcceleratorTableA
advapi32
EncryptionDisable
oleaut32
VarUI4FromUI2
shlwapi
PathStripPathA
StrStrIA
Sections
.text Size: 158KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ