Static task
static1
Behavioral task
behavioral1
Sample
0e6d858a6fdc37701028b899bc39a110_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0e6d858a6fdc37701028b899bc39a110_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
0e6d858a6fdc37701028b899bc39a110_mafia_JC.exe
-
Size
1.1MB
-
MD5
0e6d858a6fdc37701028b899bc39a110
-
SHA1
c4a24da294226674a0d68254bc98c3a4b73554bc
-
SHA256
a1f4f92bf65f1f8945eb0ac6148bb1132ea02798df22680a5effcf00319c1a8d
-
SHA512
249b164dac1b97cf6642e04856e246d3c0c868322af72dfae5bd6dfff3a4e6b70864b6ff5c896907f98218c5d992892a8314cccba0d8614abd137affdcd49b28
-
SSDEEP
24576:LoRRKMy/AFyqPa7X7KEdc3AuCEHJIvbebyaEdEzzEpZMY6/nx6DUhT4fcGAwXy:+R1lP8JccvbTdGziiY6PxuiTaA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e6d858a6fdc37701028b899bc39a110_mafia_JC.exe
Files
-
0e6d858a6fdc37701028b899bc39a110_mafia_JC.exe.exe windows x86
73198dbe7727228e6a59efb939fa1646
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsDirectoryW
PathFileExistsW
PathFindExtensionW
PathFindFileNameW
PathAddBackslashW
StrStrIA
StrStrIW
wininet
HttpQueryInfoA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetErrorDlg
HttpOpenRequestA
InternetSetStatusCallbackW
InternetReadFileExA
winspool.drv
ord203
kernel32
GetPrivateProfileStringW
WriteFile
LoadLibraryW
GetVersionExW
CreateFileW
MultiByteToWideChar
GetLastError
GetProcAddress
ResetEvent
CreateEventW
CloseHandle
lstrcmpiW
FindFirstFileW
Sleep
FindClose
WaitForMultipleObjects
FindNextFileW
lstrcpyW
MoveFileExW
OpenEventW
CreateProcessW
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingW
OpenFileMappingW
SetFilePointerEx
ReadFile
GetFileSizeEx
CreateDirectoryW
GetDateFormatW
GetLocalTime
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
GetACP
IsValidCodePage
GetLocaleInfoW
GetCurrentThreadId
SetEvent
CreateMutexW
SetLastError
ReleaseMutex
GetCurrentProcess
GetVolumeInformationW
PeekNamedPipe
WaitNamedPipeW
FlushFileBuffers
GetFileSize
FileTimeToSystemTime
MoveFileW
GetFileTime
FileTimeToLocalFileTime
GetExitCodeThread
ReleaseSemaphore
CreateSemaphoreW
OpenSemaphoreW
lstrcpynW
lstrcatW
HeapDestroy
ResumeThread
ExitProcess
HeapSize
IsProcessorFeaturePresent
GetConsoleMode
GetConsoleCP
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetOEMCP
GetCPInfo
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
WaitForSingleObject
FreeLibrary
GetCurrentProcessId
GetCommandLineW
DeleteFileW
lstrcmpW
GetFileAttributesW
WideCharToMultiByte
GetTempFileNameW
lstrlenW
QueryPerformanceCounter
GetFileType
GetSystemTimeAsFileTime
GetTickCount
LCMapStringW
SetFilePointer
SetStdHandle
WriteConsoleW
InterlockedExchange
SetEndOfFile
InitializeCriticalSection
GetStdHandle
DeleteCriticalSection
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapCreate
GetModuleFileNameW
GetTempPathW
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateThread
ExitThread
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
user32
IsWindow
DrawTextW
SetForegroundWindow
AttachThreadInput
GetForegroundWindow
GetWindowThreadProcessId
WaitForInputIdle
wsprintfW
PostMessageW
wsprintfA
LoadStringW
CharUpperW
SendMessageW
gdi32
SetTextColor
SetBkMode
DeleteObject
SelectObject
SetMapMode
StretchDIBits
CreateFontW
SetStretchBltMode
PatBlt
comdlg32
GetSaveFileNameW
advapi32
CryptDestroyHash
CryptDecrypt
CryptCreateHash
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptHashData
shell32
DoEnvironmentSubstW
SHGetFolderPathW
SHFileOperationW
ole32
CoInitialize
CoUninitialize
oleaut32
SysFreeString
vcomp100
_vcomp_fork
_vcomp_for_static_simple_init
_vcomp_for_static_end
Sections
.text Size: 411KB - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 596KB - Virtual size: 600KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE