Behavioral task
behavioral1
Sample
2024-11-25_d836ab81b311683bfffa7138ce72e4ff_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-11-25_d836ab81b311683bfffa7138ce72e4ff_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-11-25_d836ab81b311683bfffa7138ce72e4ff_mafia
-
Size
424KB
-
MD5
d836ab81b311683bfffa7138ce72e4ff
-
SHA1
8b8cc285ef5832ce52221ef748160ec50b81b70d
-
SHA256
ea9fa4d1a49baa037c8478d9e0575c26ea5f32fef6b66c6b16e590748c310ec1
-
SHA512
4162e75f691577bd45b2f926106038a373a2df27cc3a234aa441b5c660860922577fa5a04500df5136caee3cb0891932e666916bfb1d02fbd0d7ac149e69b2dd
-
SSDEEP
6144:j7TdaVFchLKHBy5jUQBggMc6CLl+EVivve60s5t9iARkUeF0s:j7ToVFMLKg5jfbMrV+ivve60+jdRxs
Malware Config
Signatures
-
Vidar family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-11-25_d836ab81b311683bfffa7138ce72e4ff_mafia
Files
-
2024-11-25_d836ab81b311683bfffa7138ce72e4ff_mafia.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 248KB - Virtual size: 247KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ