Static task
static1
Behavioral task
behavioral1
Sample
2025-02-16_5b692034c8d92d39d0dce48a26023190_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-02-16_5b692034c8d92d39d0dce48a26023190_mafia.exe
Resource
win10v2004-20250211-en
General
-
Target
2025-02-16_5b692034c8d92d39d0dce48a26023190_mafia
-
Size
331KB
-
MD5
5b692034c8d92d39d0dce48a26023190
-
SHA1
75476d84efa525812ad90774a00b8f02ae4c88d8
-
SHA256
3399fa00813d7df440adaedb1817cbbec28e303fdffc46191e6415ad20c78b94
-
SHA512
d58cf25b6729a6bbd31096e89b4dab2ff2c07da4d2da23e27268f1bf03e9a5ba184d39a96d2e157666d4c583a7c26f984d6f46a48b1b3cd010604aa5da6070b5
-
SSDEEP
6144:cu4PqtlK7KWQhbrsKaFnlHDqwRBbRCgf0BabAYviFsJyAFtHet:iPq/K7KWmrsKunhDfCsriqxve
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-02-16_5b692034c8d92d39d0dce48a26023190_mafia
Files
-
2025-02-16_5b692034c8d92d39d0dce48a26023190_mafia.exe windows:5 windows x86 arch:x86
f60b95ab24d66ab2adee7f5ef5bf8b07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynW
WritePrivateProfileStructW
GetVolumePathNamesForVolumeNameW
VerifyVersionInfoA
IsBadWritePtr
ReplaceFileW
GetModuleFileNameW
lstrlenW
DisconnectNamedPipe
GetProcAddress
GetLongPathNameA
PeekConsoleInputW
CopyFileA
EnumSystemCodePagesW
GlobalGetAtomNameA
SetFileAttributesA
BuildCommDCBW
LoadLibraryA
ProcessIdToSessionId
LocalAlloc
TransmitCommChar
LockResource
SetFileApisToANSI
QueryDosDeviceW
GlobalGetAtomNameW
GetSystemPowerStatus
AddAtomA
Module32FirstW
WaitForMultipleObjects
GlobalWire
FindNextFileA
WTSGetActiveConsoleSessionId
GetProcessAffinityMask
GetCPInfoExA
SetFileShortNameA
GetDiskFreeSpaceExW
WriteFileEx
GetWindowsDirectoryW
GetVolumeNameForVolumeMountPointW
MoveFileWithProgressW
GetThreadTimes
FindActCtxSectionStringW
SetFileAttributesW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
SetEndOfFile
GetStringTypeW
LCMapStringW
WriteFileGather
WriteFile
GetNumberFormatA
FindNextVolumeMountPointA
GetProcessHeap
OutputDebugStringW
FreeEnvironmentStringsA
GetCommProperties
GetSystemDefaultLCID
FindFirstFileExW
WriteConsoleInputA
GlobalDeleteAtom
ScrollConsoleScreenBufferW
ReadConsoleA
OpenJobObjectA
WriteTapemark
LoadLibraryExW
HeapAlloc
FindResourceW
GetCPInfo
lstrlenA
SetConsoleWindowInfo
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
GetLastError
HeapFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
MultiByteToWideChar
ReadFile
CloseHandle
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
FatalAppExitA
CreateFileA
SetStdHandle
FlushFileBuffers
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
HeapReAlloc
WriteConsoleW
IsValidLocale
user32
LoadStringA
GetMonitorInfoA
SetMenuInfo
GetMenuInfo
OemToCharBuffA
RealChildWindowFromPoint
advapi32
AbortSystemShutdownA
SetPrivateObjectSecurity
InitiateSystemShutdownW
AdjustTokenPrivileges
LookupPrivilegeDisplayNameW
ClearEventLogA
RegReplaceKeyA
EnumServicesStatusW
RegDeleteValueW
GetAce
OpenBackupEventLogA
RegDeleteKeyW
RegOpenKeyW
DuplicateToken
RegQueryMultipleValuesW
LogonUserW
OpenEventLogW
RegisterEventSourceW
RegSetValueA
CreateProcessAsUserA
DestroyPrivateObjectSecurity
Sections
.text Size: 157KB - Virtual size: 157KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ