Static task
static1
Behavioral task
behavioral1
Sample
fa9ffb2ce1300e3ab1713712843c1f2c_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
fa9ffb2ce1300e3ab1713712843c1f2c_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
fa9ffb2ce1300e3ab1713712843c1f2c_mafia_JC.exe
-
Size
1.3MB
-
MD5
fa9ffb2ce1300e3ab1713712843c1f2c
-
SHA1
6416634f96eae14f836139e7c52eaca44bb3822a
-
SHA256
87491d1907bb60000d71f461a44530d645f6b5eda4905371a312a6e9fa6683f6
-
SHA512
7f958cbd17db57e7f92e5fb8d2170cefb173725e6861a481b9e28cd5326076f92613378ff91551cbe8fbcb3f15e1b0f8507915655133697585d1aeea2c411677
-
SSDEEP
24576:HlZJ4RKbMboZwDwWJyvJbYAVte366nMar1PcYc89inxLs3EL05q2Z/IrCFFZ:zJ4R5boZwDLyRbYAfWnMarh7P9inm4uN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa9ffb2ce1300e3ab1713712843c1f2c_mafia_JC.exe
Files
-
fa9ffb2ce1300e3ab1713712843c1f2c_mafia_JC.exe.exe windows x86
e3309230b664f41d6e2ca139d1288dc7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wintrust
WinVerifyTrust
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
kernel32
GetTempFileNameA
GetTempPathA
FlushFileBuffers
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
GetEnvironmentVariableA
CreateDirectoryW
GetCurrentDirectoryW
OutputDebugStringA
InterlockedIncrement
InterlockedDecrement
GetLocalTime
SetThreadPriority
GetCurrentThread
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
DeleteFileA
GetCurrentDirectoryA
GetSystemInfo
ExpandEnvironmentStringsA
GetSystemDirectoryA
LocalFree
LocalAlloc
lstrlenA
RemoveDirectoryA
lstrlenW
GetCurrentProcess
Sleep
GetShortPathNameA
GetLongPathNameA
SetEnvironmentVariableA
MoveFileA
CopyFileA
GetFileAttributesA
ReleaseMutex
CreateMutexA
WaitForMultipleObjects
MultiByteToWideChar
HeapFree
GetPrivateProfileSectionA
HeapAlloc
GetProcessHeap
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
RaiseException
ResumeThread
SuspendThread
SetPriorityClass
GetThreadTimes
CreateFileW
DeviceIoControl
DuplicateHandle
CreateEventA
SetEvent
GetCurrentProcessId
GetModuleHandleA
SearchPathA
lstrcmpiA
GetFullPathNameA
GlobalFree
GlobalAlloc
lstrcpynA
SetCurrentDirectoryA
SetLastError
IsBadReadPtr
SystemTimeToFileTime
GetStringTypeW
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
SetStdHandle
SetHandleCount
GetFileType
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
IsProcessorFeaturePresent
RemoveDirectoryW
DeleteFileW
FindNextFileW
GetVersionExW
GetFileAttributesW
SetFileAttributesW
MoveFileExW
GetTempFileNameW
CopyFileW
GetShortPathNameW
GetWindowsDirectoryA
CreateFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
FindFirstFileW
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
CloseHandle
CreateDirectoryA
FindFirstFileA
MoveFileExA
FindNextFileA
FindClose
GetLastError
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
EnumSystemLocalesA
IsValidLocale
SetEndOfFile
GetDriveTypeW
GetTimeZoneInformation
CreateThread
CompareStringW
GetCurrentThreadId
TlsFree
TlsSetValue
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
TlsGetValue
TlsAlloc
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
EncodePointer
DecodePointer
RtlUnwind
GetConsoleCP
GetConsoleMode
VirtualProtect
VirtualAlloc
GetModuleHandleW
VirtualQuery
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetSystemTimeAsFileTime
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
user32
ExitWindowsEx
PostThreadMessageA
RegisterClassA
CreateWindowExA
SetWindowRgn
ShowWindow
GetMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
DefWindowProcA
CharNextA
LoadStringA
wsprintfA
advapi32
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyA
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus
RegDeleteKeyA
EnumServicesStatusExA
CreateServiceA
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
RegEnumValueA
LockServiceDatabase
UnlockServiceDatabase
ControlService
QueryServiceStatus
QueryServiceConfig2A
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
QueryServiceConfigA
ChangeServiceConfigA
ChangeServiceConfig2A
GetSecurityDescriptorControl
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHGetFolderPathA
ole32
CoUninitialize
StringFromCLSID
CoCreateGuid
CoInitialize
CoTaskMemFree
oleaut32
SysAllocStringLen
SysFreeString
SysAllocString
shlwapi
PathAppendA
SHDeleteValueA
PathRemoveFileSpecA
Sections
.text Size: 314KB - Virtual size: 313KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 357KB - Virtual size: 357KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 592KB - Virtual size: 596KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE