Static task
static1
Behavioral task
behavioral1
Sample
872d279e37a169d7894b454d152d38f1_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
872d279e37a169d7894b454d152d38f1_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
872d279e37a169d7894b454d152d38f1_mafia_JC.exe
-
Size
212KB
-
MD5
872d279e37a169d7894b454d152d38f1
-
SHA1
15dad1393faa2c81482804b5c3d65fa0a2dd32d5
-
SHA256
547d3e087d1556dc8e72512439e36d0d717e077229104674db04f527efceaf91
-
SHA512
697d67c6ebf44683676318719c2ceabe156aa58237fe27cbe19123703e06ab998816507a561e85c623490f6e070aa4ecbe0b56928e3b6daf5e5b9acac4e9bcf5
-
SSDEEP
3072:br/F5NK9oSCMXfbyPZ+3YjA67bbuSqFdABh6apYb8RJkqosSzJt0O8:n/FbK9xCMPbyRaYEGb8du6n8XkXzrJ8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 872d279e37a169d7894b454d152d38f1_mafia_JC.exe
Files
-
872d279e37a169d7894b454d152d38f1_mafia_JC.exe.exe windows x86
e659fd300a7a120c2ce64a952712b2d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateToolhelp32Snapshot
Module32Next
CloseHandle
QueryPerformanceCounter
GetTickCount
Thread32First
CreateProcessA
Thread32Next
FindFirstFileA
GetLastError
FindClose
OpenThread
FindNextFileA
GetCurrentThreadId
SuspendThread
ResumeThread
GetComputerNameA
GetCurrentProcess
Process32First
GetModuleHandleA
GetSystemWow64DirectoryA
OpenProcess
GetVolumeInformationA
VirtualFreeEx
ReadProcessMemory
GetSystemDirectoryA
GetProcAddress
VirtualAllocEx
Process32Next
GetExitCodeThread
GetModuleFileNameA
GetCurrentProcessId
GetTempPathA
WriteProcessMemory
GetThreadContext
SetThreadContext
VirtualAlloc
LoadLibraryExA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
Module32First
Sleep
CreateRemoteThread
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetProcessHeap
SetFilePointer
ReadFile
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
GetModuleHandleW
ExitProcess
GetCommandLineA
HeapSetInformation
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetACP
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryW
GetLocaleInfoW
SetHandleCount
GetFileType
GetStartupInfoW
user32
MessageBoxA
advapi32
GetTokenInformation
OpenProcessToken
GetUserNameA
shell32
ShellExecuteA
wininet
InternetReadFile
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
psapi
GetModuleFileNameExA
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ