D:\temp\tk4ftev2.am3\TempMain\MSI\RST\Release\Setup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-26_9554b1bd8310387ca2622f7b2f19a3fc_mafia_wapomi.exe
Resource
win7-20240708-en
General
-
Target
2024-12-26_9554b1bd8310387ca2622f7b2f19a3fc_mafia_wapomi
-
Size
1.2MB
-
MD5
9554b1bd8310387ca2622f7b2f19a3fc
-
SHA1
5252a01bf06ee27f83e2f1cda4472bba740181c3
-
SHA256
161b5a9456c3bdbe892fffec5293d0b44c6dbe34e120e32d06f9d209912a22bf
-
SHA512
16f38ef7866fdbd69d9a72da9c4a4af57e535b8b609955dd1ff05582313084e0a2ee7f1add135fd3e2f3b01e4a0d7a8bb49e1faca5fc02525b066b3f97f6e655
-
SSDEEP
24576:Bvt509XOA2NMW8NJiJ9A99JK45yWl8pHu1FxU5A2qH:BvY9XORNMW8NYJejJLzIu1FxZ2y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-26_9554b1bd8310387ca2622f7b2f19a3fc_mafia_wapomi
Files
-
2024-12-26_9554b1bd8310387ca2622f7b2f19a3fc_mafia_wapomi.exe windows:5 windows x86 arch:x86
3b99ec52565021c75c59b7a2a01f57e9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetUserDefaultUILanguage
GetTempPathW
GetTempFileNameW
LoadLibraryExW
GetTickCount
CreateFileW
SetFilePointer
GetLocalTime
WriteFile
CloseHandle
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
MoveFileW
MoveFileExW
ExpandEnvironmentStringsW
GetFileSize
ReadFile
SizeofResource
GetFileAttributesW
IsWow64Process
GetCurrentProcess
MultiByteToWideChar
CreateProcessW
GetExitCodeProcess
GetCurrentDirectoryW
GetDriveTypeW
GetProcAddress
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
MulDiv
GetConsoleMode
GetConsoleCP
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapSize
GetSystemTimeAsFileTime
GetUserDefaultLangID
QueryPerformanceCounter
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
IsProcessorFeaturePresent
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
HeapAlloc
CreateThread
GetCurrentThreadId
ExitThread
HeapFree
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
GetLocaleInfoW
FreeLibrary
EnumResourceLanguagesW
GetSystemPowerStatus
GetVersionExW
GetCommandLineW
GetVersion
LoadLibraryW
DeleteFileW
RemoveDirectoryW
CopyFileW
SetFileAttributesW
GetModuleFileNameW
LoadLibraryA
LocalAlloc
lstrlenW
InterlockedDecrement
ReleaseMutex
WaitForSingleObject
GetLastError
CreateMutexW
LocalFree
FormatMessageW
ExitProcess
LockResource
LoadResource
GetModuleHandleW
FindResourceW
GetStringTypeW
WideCharToMultiByte
InterlockedExchange
InterlockedCompareExchange
InterlockedIncrement
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetCurrentProcessId
user32
InflateRect
SetClassLongW
MapDialogRect
OffsetRect
ShowWindow
AdjustWindowRectEx
SetRectEmpty
ExitWindowsEx
LoadCursorW
SetCursor
SetFocus
PostMessageW
CopyRect
MapWindowPoints
GetSystemMetrics
GetClassNameW
ReleaseDC
DrawTextW
GetDC
GetWindowTextLengthW
LoadStringW
MessageBoxW
MoveWindow
wsprintfW
MessageBoxIndirectW
FillRect
SetRect
GetWindowLongW
EnableWindow
LoadImageW
SetDlgItemTextW
InvalidateRect
GetParent
CreateWindowExW
EndDialog
SetWindowTextW
GetWindowTextW
GetWindow
GetDlgItem
GetClientRect
SetWindowPos
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
DestroyWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
SetWindowLongW
CreateDialogIndirectParamW
SendMessageW
CallWindowProcW
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
DeleteDC
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
SetBkMode
SetTextColor
GetObjectW
CreateFontW
GetStockObject
GetTextMetricsW
advapi32
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
shell32
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHFileOperationW
CommandLineToArgvW
SHCreateDirectoryExW
SHGetFolderPathW
SHGetFolderLocation
ole32
OleRun
CoCreateInstance
CoInitialize
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
VariantInit
VariantCopy
VariantClear
SysAllocString
shlwapi
PathGetCharTypeW
PathSkipRootW
PathStripToRootW
PathCombineW
PathIsRelativeW
PathMatchSpecW
PathFileExistsW
PathRemoveArgsW
PathGetArgsW
PathRemoveFileSpecW
PathQuoteSpacesW
PathFindFileNameW
PathRemoveExtensionW
PathFindExtensionW
PathAppendW
PathIsUNCW
setupapi
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupOpenInfFileW
SetupDiDestroyDeviceInfoList
SetupCloseInfFile
SetupFindFirstLineW
SetupFindNextLine
SetupGetStringFieldW
SetupGetLineTextW
cabinet
ord23
ord22
ord20
Sections
.text Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 852KB - Virtual size: 851KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
����uW Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE