bodiaga
Static task
static1
Behavioral task
behavioral1
Sample
2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia
-
Size
13.6MB
-
MD5
a60ac9f9f8401b075313d1ea5ed38a3d
-
SHA1
a399ae72488052b9a5b629b0bc9d5c47e4b503e3
-
SHA256
48cd6c50ceff5d85c03b03b9864b6631983bf8b5a0b2a599857b924aad773da0
-
SHA512
33dbb5926885e65db4ba08ecd4595f945e77062ab3932d4a58a2b53ca07391c2256a3d5a3349deb76d45bedee7800a3e1160f60893b5baa9aa99812167a3871a
-
SSDEEP
24576:C6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ3:LWdLQk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia
Files
-
2025-01-10_a60ac9f9f8401b075313d1ea5ed38a3d_mafia.exe windows:5 windows x86 arch:x86
cdd4ab8bbe92e4bdb4929b1e9e0e582a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GetProcessTimes
GetCurrencyFormatW
SetFileShortNameW
SizeofResource
GetFileAttributesA
IsDBCSLeadByte
lstrlenW
FindNextVolumeMountPointW
GetStringTypeExA
GetNamedPipeHandleStateW
GetLargestConsoleWindowSize
GetHandleInformation
ReadFileEx
SetComputerNameA
VirtualProtectEx
SearchPathA
GetSystemTimes
GetAtomNameA
LoadLibraryA
LocalAlloc
QueryDosDeviceW
HeapLock
LoadLibraryExA
DebugBreakProcess
FatalExit
GetPrivateProfileSectionA
VirtualProtect
SetProcessShutdownParameters
LocalSize
GetTempPathA
OpenFileMappingA
EnumSystemLocalesW
SuspendThread
SetCommTimeouts
GetCommandLineA
GetUserDefaultLangID
SetTapeParameters
BackupSeek
SleepEx
AddConsoleAliasW
GlobalLock
GlobalSize
SetConsoleActiveScreenBuffer
ReadConsoleA
GlobalAddAtomA
FindResourceW
GetProcessIoCounters
UnmapViewOfFile
PeekNamedPipe
FindFirstFileW
GlobalMemoryStatus
CreateFileA
GetPrivateProfileStringA
FileTimeToDosDateTime
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
IsProcessorFeaturePresent
HeapSize
FatalAppExitA
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointer
GetConsoleCP
GetConsoleMode
FreeLibrary
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
CloseHandle
FlushFileBuffers
advapi32
AddAccessDeniedAceEx
RegLoadKeyA
GetServiceDisplayNameW
RegSaveKeyA
AllocateAndInitializeSid
RegDeleteValueA
RegDeleteValueW
LookupPrivilegeValueA
NotifyChangeEventLog
DeregisterEventSource
EqualPrefixSid
GetSidSubAuthorityCount
OpenServiceW
MapGenericMask
SetServiceObjectSecurity
AccessCheckAndAuditAlarmW
RegRestoreKeyW
GetSidSubAuthority
GetCurrentHwProfileA
SetSecurityDescriptorSacl
Exports
Exports
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13.3MB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ