Static task
static1
Behavioral task
behavioral1
Sample
95f7fca8448e0be23afc5be16ccd6498_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
95f7fca8448e0be23afc5be16ccd6498_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
95f7fca8448e0be23afc5be16ccd6498_mafia_JC.exe
-
Size
190KB
-
MD5
95f7fca8448e0be23afc5be16ccd6498
-
SHA1
0f39d6608bd4635b71c3a02aa2e98aef4c0d62da
-
SHA256
5313da30b0deeda63c515fdcae3cd502cf98a4add60706ab6bde40afb07818f3
-
SHA512
1f4be3efb4fa51347f558d792659d1a5033878b20c0b34990c00fccb58038f0d28d4793d02889594ff4569c3b0242cfc6579a67681106dde1f86c1813d073d76
-
SSDEEP
3072:aYE3BdE+SBy+LdWkVMh7QqZrUgB4Ao5GtZoGfU9K0HEbB9Bd:aYE3BUByuz+z4gFbZss8g
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 95f7fca8448e0be23afc5be16ccd6498_mafia_JC.exe
Files
-
95f7fca8448e0be23afc5be16ccd6498_mafia_JC.exe.exe windows x86
ff0d45caaf9571a1c3ce461d9646bbd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
GetProcessHeap
OpenProcess
GetProcAddress
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
GetFullPathNameA
GetSystemTime
TerminateProcess
FindClose
FindNextFileA
FindFirstFileA
SetConsoleTextAttribute
GetStdHandle
ExitProcess
GetVolumeInformationA
WriteFile
GetConsoleWindow
GetComputerNameA
CreateProcessA
DeleteFileA
CopyFileA
GetTempPathA
IsDebuggerPresent
SetConsoleTitleA
CompareStringW
SetEndOfFile
CreateFileW
GetExitCodeProcess
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
HeapReAlloc
GetStringTypeW
GetCurrentProcessId
WideCharToMultiByte
GetCurrentProcess
GetLastError
CreateFileA
CloseHandle
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetFileAttributesA
GetLocaleInfoW
LoadLibraryW
SetFilePointer
SetEnvironmentVariableA
Sleep
ReadFile
GetStartupInfoW
SetHandleCount
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetModuleHandleW
WriteConsoleW
GetFileType
GetModuleFileNameW
GetCommandLineA
HeapSetInformation
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
HeapCreate
GetConsoleCP
GetConsoleMode
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
user32
LoadCursorA
GetSystemMetrics
GetWindowRect
MessageBoxA
LoadIconA
DefWindowProcA
CreateWindowExA
RegisterWindowMessageA
DestroyIcon
RegisterClassExA
SetWindowPos
advapi32
RegSetValueExA
GetUserNameA
RegOpenKeyExA
AdjustTokenPrivileges
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
shell32
ShellExecuteA
Shell_NotifyIconA
wininet
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetConnectW
InternetCloseHandle
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameA
Sections
.text Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 997KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ