bodiaga
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-19_08354967a1a2f5d0c78d5c7d0a80a9bf_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-12-19_08354967a1a2f5d0c78d5c7d0a80a9bf_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-19_08354967a1a2f5d0c78d5c7d0a80a9bf_mafia
-
Size
11.3MB
-
MD5
08354967a1a2f5d0c78d5c7d0a80a9bf
-
SHA1
65c97fda58d573ad7aaa0677c7d4323a35bd67ed
-
SHA256
c46a5bf2d8001c12538128dec7dbc3563ee98be85f7403624bf48b9e4725d82e
-
SHA512
66f404ddcba83f7c5514a8c5f00254177a079361bb72fa0c16fa8094c021b231adf9cc9c978db7f00c261b88c86cb5cac24aac6f20b818847943ac80d995d271
-
SSDEEP
3072:LLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:yOMdRQr7OB0ypmMXnl8XEPM3noSWOC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-19_08354967a1a2f5d0c78d5c7d0a80a9bf_mafia
Files
-
2024-12-19_08354967a1a2f5d0c78d5c7d0a80a9bf_mafia.exe windows:5 windows x86 arch:x86
eed351385158b7f7a0075368d27716ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindFirstFileExW
SleepEx
BackupSeek
SetTapeParameters
GetConsoleAliasesA
GetUserDefaultLangID
SetCommState
GetCommandLineA
GetSystemTimes
GetDriveTypeA
GetProcessTimes
GetCurrencyFormatW
GlobalAlloc
SetFileShortNameW
SizeofResource
GetFileAttributesA
lstrlenW
FindNextVolumeMountPointW
WritePrivateProfileStringW
GetStringTypeExA
GetNamedPipeHandleStateW
GetLargestConsoleWindowSize
GetHandleInformation
IsDBCSLeadByteEx
VirtualAlloc
ReadFileEx
RemoveDirectoryA
AddConsoleAliasW
VirtualProtectEx
GetPrivateProfileStringA
OpenWaitableTimerA
GetAtomNameA
LoadLibraryA
RegisterWaitForSingleObject
CreateFileMappingA
LocalAlloc
QueryDosDeviceW
HeapLock
GetTapeParameters
LoadLibraryExA
DebugBreakProcess
FatalExit
GetPrivateProfileSectionA
VirtualProtect
GetConsoleCursorInfo
SetProcessShutdownParameters
LocalSize
GlobalAddAtomW
GetTempPathA
OpenFileMappingA
InterlockedPushEntrySList
EnumSystemLocalesW
SuspendThread
GlobalLock
GlobalSize
SetConsoleActiveScreenBuffer
InterlockedDecrement
ReadConsoleA
WriteTapemark
HeapAlloc
LocalCompact
FindResourceW
FileTimeToDosDateTime
GetProcessIoCounters
GlobalCompact
UnmapViewOfFile
GetLocaleInfoA
PeekNamedPipe
FindFirstFileW
SearchPathW
GlobalMemoryStatus
CreateFileA
SetComputerNameA
InterlockedIncrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
FatalAppExitA
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
CloseHandle
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileW
advapi32
DeregisterEventSource
SetSecurityDescriptorSacl
AddAccessDeniedAceEx
RegLoadKeyA
GetServiceDisplayNameW
AllocateAndInitializeSid
RegDeleteValueW
LookupPrivilegeValueA
NotifyChangeEventLog
RegSaveKeyW
EqualPrefixSid
GetSidSubAuthorityCount
OpenServiceW
MapGenericMask
SetServiceObjectSecurity
AccessCheckAndAuditAlarmW
RegRestoreKeyW
GetSidSubAuthority
GetCurrentHwProfileA
Exports
Exports
Sections
.text Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11.1MB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ