Static task
static1
Behavioral task
behavioral1
Sample
1d23dce488e2c76add0f724c0f7c90e4_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1d23dce488e2c76add0f724c0f7c90e4_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
1d23dce488e2c76add0f724c0f7c90e4_mafia_JC.exe
-
Size
232KB
-
MD5
1d23dce488e2c76add0f724c0f7c90e4
-
SHA1
8177563937465b0627f19b30ac9ab9e47ce05f5a
-
SHA256
f974b236779617149bb00aab7674dd60cd35626f1a5a8a06972edde25fc73213
-
SHA512
0cca8086ef56abb81ecdb4744e9ba14cc019124c6933dd537b73c07d1ae6f1b51541e536b29b62ac6fa42e2dba76741c953d89c30b8772c84cdc385b1781be4d
-
SSDEEP
6144:DdpPKDVQaq+RyQrfSivLrfu661MnWLfo26vB:X0pLTu66Wmfo26v
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1d23dce488e2c76add0f724c0f7c90e4_mafia_JC.exe
Files
-
1d23dce488e2c76add0f724c0f7c90e4_mafia_JC.exe.exe windows x86
0578f468871acb6ca0cf9a5fe51395c0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
CreateFileW
WriteFile
FlushFileBuffers
GetFileSize
ReadFile
SetFilePointer
LoadLibraryW
GetProcAddress
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateMutexW
ReleaseMutex
SetEndOfFile
CopyFileW
GetCurrentThreadId
FileTimeToLocalFileTime
FileTimeToSystemTime
DeviceIoControl
GetTickCount
CreateFileA
SetLastError
WriteConsoleW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
TlsFree
TlsSetValue
TlsGetValue
GetProcessHeap
HeapAlloc
MultiByteToWideChar
GetCurrentProcess
IsWow64Process
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SizeofResource
CloseHandle
TerminateProcess
GetCurrentProcessId
GetLastError
GetLongPathNameW
GetModuleHandleW
GetModuleFileNameW
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetStdHandle
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
LockResource
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
RaiseException
HeapSize
HeapDestroy
HeapReAlloc
SetStdHandle
user32
ShowWindow
UpdateWindow
SetTimer
PostQuitMessage
KillTimer
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadStringW
DefWindowProcW
LoadAcceleratorsW
advapi32
FreeSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegOpenKeyW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
LookupAccountSidW
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ