Static task
static1
Behavioral task
behavioral1
Sample
94c3217c092bb11dd97be6fc6582a527_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
94c3217c092bb11dd97be6fc6582a527_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
94c3217c092bb11dd97be6fc6582a527_mafia_JC.exe
-
Size
493KB
-
MD5
94c3217c092bb11dd97be6fc6582a527
-
SHA1
c0dbb6bb9218342540feb6652a494752c41c3191
-
SHA256
b66ec7dd5ed2d96e6470be8070e504ad95512a2419f4d45cab9ed68952dee32b
-
SHA512
1fb2b231839d129b36b0f339ad7a8945e2d51e4b50a4d448fd21f99e532d5201086535ddea622341897fc2e08c644a3b6481afe3202d1cd94aaa26b9cdef4ec6
-
SSDEEP
12288:wnWZI0E3SWo9BnqoddvjJFHYCC5CACCysCDC4s4bUK6:wWG0YunqMvFHYCC5CACCysCDCCba
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94c3217c092bb11dd97be6fc6582a527_mafia_JC.exe
Files
-
94c3217c092bb11dd97be6fc6582a527_mafia_JC.exe.exe windows x86
cdc00d120028607e4c4c042496741acd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
duilib
?GetHeight@CDuiRect@DuiLib@@QBEHXZ
?GetWidth@CDuiRect@DuiLib@@QBEHXZ
?Offset@CDuiRect@DuiLib@@QAEXHH@Z
??0CDuiRect@DuiLib@@QAE@ABUtagRECT@@@Z
?Init@CPaintManagerUI@DuiLib@@QAEXPAUHWND__@@H@Z
??0CDuiRect@DuiLib@@QAE@XZ
?GetRoundCorner@CPaintManagerUI@DuiLib@@QBE?AUtagSIZE@@XZ
??1CPaintManagerUI@DuiLib@@QAE@XZ
??0CDialogBuilder@DuiLib@@QAE@XZ
?AddPreMessageFilter@CPaintManagerUI@DuiLib@@QAE_NPAVIMessageFilterUI@2@@Z
?GetData@CDuiString@DuiLib@@QBEPB_WXZ
??YCDuiString@DuiLib@@QAEABV01@PB_W@Z
?GetResourceDll@CPaintManagerUI@DuiLib@@SAPAUHINSTANCE__@@XZ
?SetResourceZip@CPaintManagerUI@DuiLib@@SAXPAXI@Z
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z
?AttachDialog@CPaintManagerUI@DuiLib@@QAE_NPAVCControlUI@2@@Z
?AddNotifier@CPaintManagerUI@DuiLib@@QAE_NPAVINotifyUI@2@@Z
?SetBackgroundTransparent@CPaintManagerUI@DuiLib@@QAEX_N@Z
??1CMarkup@DuiLib@@QAE@XZ
?MessageHandler@CPaintManagerUI@DuiLib@@QAE_NIIJAAJ@Z
??0CPaintManagerUI@DuiLib@@QAE@XZ
?GetCaptionRect@CPaintManagerUI@DuiLib@@QAEAAUtagRECT@@XZ
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@UtagPOINT@@@Z
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
??8CDuiString@DuiLib@@QBE_NPB_W@Z
??0CDuiString@DuiLib@@QAE@PB_WH@Z
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?GetInstancePath@CPaintManagerUI@DuiLib@@SA?AVCDuiString@2@XZ
??HCDuiString@DuiLib@@QBE?AV01@PB_W@Z
??BCDuiString@DuiLib@@QBEPB_WXZ
?SetResourcePath@CPaintManagerUI@DuiLib@@SAXPB_W@Z
??1CDuiString@DuiLib@@QAE@XZ
?GetMinInfo@CPaintManagerUI@DuiLib@@QBE?AUtagSIZE@@XZ
?SetResourceZip@CPaintManagerUI@DuiLib@@SAXPB_W_N@Z
softinstall
Start
Stop
InitEnvironment
kernel32
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
FreeLibrary
LoadLibraryExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetCommandLineW
CreateMutexW
LoadLibraryW
ExitProcess
FreeResource
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
InterlockedExchange
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
GetStringTypeW
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetStdHandle
WriteFile
HeapCreate
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetModuleHandleW
GetProcAddress
GetCurrentThreadId
FlushInstructionCache
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameW
GetLastError
LocalFree
GetVersion
lstrlenA
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
RaiseException
WideCharToMultiByte
MultiByteToWideChar
GetVolumeInformationW
GetVersionExW
GetTickCount
Sleep
FindFirstFileW
FindClose
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
GetCurrentProcess
CloseHandle
GetOEMCP
GetACP
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapDestroy
user32
PostMessageW
SetWindowLongW
MoveWindow
GetClientRect
ShowWindow
ReleaseDC
GetClassInfoExW
LoadCursorW
CharNextW
RegisterClassExW
DestroyWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
GetWindowRect
GetDC
SetParent
SetWindowRgn
MonitorFromWindow
GetMonitorInfoW
IsIconic
SetWindowPos
SendMessageW
GetWindowLongW
ScreenToClient
PostQuitMessage
IsZoomed
CallWindowProcW
IsWindow
DefWindowProcW
MessageBoxW
UnregisterClassA
gdi32
CreateRoundRectRgn
GetObjectW
CreateCompatibleBitmap
SelectObject
CreateSolidBrush
DeleteObject
SetGraphicsMode
SetWorldTransform
DeleteDC
BitBlt
CreateCompatibleDC
PatBlt
advapi32
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
StartServiceW
QueryServiceStatusEx
CloseServiceHandle
OpenServiceW
OpenSCManagerW
SetNamedSecurityInfoW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
RegQueryValueW
RegQueryValueExW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
OpenProcessToken
shell32
ord165
SHChangeNotify
ord680
SHGetFolderPathW
CommandLineToArgvW
ole32
CoInitialize
OleInitialize
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
VarUI4FromStr
wininet
InternetCloseHandle
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
gdiplus
GdiplusShutdown
GdiplusStartup
shlwapi
PathIsDirectoryW
PathRemoveFileSpecW
comctl32
InitCommonControlsEx
Sections
.text Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ