Static task
static1
Behavioral task
behavioral1
Sample
2025-01-13_110add3fa6022797faf045125eee1b99_mafia.exe
Resource
win7-20240903-en
General
-
Target
2025-01-13_110add3fa6022797faf045125eee1b99_mafia
-
Size
312KB
-
MD5
110add3fa6022797faf045125eee1b99
-
SHA1
0626db8390653b9f06f502340135be717898581c
-
SHA256
201603841885db2a6499da3de0e24566677f88261a173b9b627cc59c71ec8254
-
SHA512
18e7d55424793c4f600fa84af50ae076838c70da851fe269fedc554a431ddc3bb68610866663605c9c54eb92bc5025f3f2989f59e7a0200ed1e25140e2d0f4a7
-
SSDEEP
6144:/q5pKPwVsrNKjfP35fP7nCYA4TkTfpYt:WpyweZKjfP3dPBJTkL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-01-13_110add3fa6022797faf045125eee1b99_mafia
Files
-
2025-01-13_110add3fa6022797faf045125eee1b99_mafia.exe windows:5 windows x86 arch:x86
72a82190e1cfad5d039faf8b230454f8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFileShortNameW
LoadLibraryW
GetStringTypeExW
GetExitCodeProcess
Beep
GetFileAttributesW
GetAtomNameW
CreateFileW
lstrlenW
FindNextVolumeMountPointW
IsBadStringPtrA
LCMapStringA
GetLargestConsoleWindowSize
EnumSystemLocalesA
GlobalAlloc
GetLastError
HeapUnlock
BuildCommDCBW
GetProcessVersion
GetTapeParameters
DebugSetProcessKillOnExit
SetConsoleTitleW
GetProcessShutdownParameters
LoadLibraryExA
VirtualProtect
LocalSize
GetPrivateProfileSectionW
AddConsoleAliasA
OpenFileMappingA
GetCurrencyFormatW
GetDriveTypeA
SetCommTimeouts
GetCommandLineA
GetCurrencyFormatA
FormatMessageA
EnumCalendarInfoExW
SetTapeParameters
BackupSeek
CreateHardLinkA
FlushConsoleInputBuffer
GetUserDefaultLCID
GlobalLock
GetNamedPipeHandleStateA
WriteTapemark
LocalCompact
MapViewOfFile
FindFirstFileW
GlobalDeleteAtom
GetHandleInformation
FileTimeToDosDateTime
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetCPInfo
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetCurrentThread
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeW
GetLocaleInfoW
HeapSize
FatalAppExitA
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointer
GetConsoleCP
GetConsoleMode
FreeLibrary
SetStdHandle
WriteConsoleW
FlushFileBuffers
ReadFile
CloseHandle
advapi32
CloseEventLog
GetServiceDisplayNameA
GetLengthSid
GetSecurityDescriptorSacl
RegLoadKeyA
AllocateAndInitializeSid
RegDeleteValueW
LookupPrivilegeValueA
DeregisterEventSource
EqualSid
RegSetValueExA
RegRestoreKeyA
AddAccessAllowedAceEx
SetServiceObjectSecurity
AccessCheckAndAuditAlarmW
IsValidAcl
LookupPrivilegeNameW
OpenServiceA
GetCurrentHwProfileA
GetSecurityDescriptorDacl
Sections
.text Size: 202KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 41.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vetiba Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wule Size: 1KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ