Static task
static1
Behavioral task
behavioral1
Sample
ac48102068a9cdc5c55a28a7f1077697_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ac48102068a9cdc5c55a28a7f1077697_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
ac48102068a9cdc5c55a28a7f1077697_mafia_JC.exe
-
Size
407KB
-
MD5
ac48102068a9cdc5c55a28a7f1077697
-
SHA1
f151ae359bea94f7dea7f3f59cdb26eec005ce5d
-
SHA256
0b418c5c4b793ac9faf211596c04d3911acdb4afa5a6fbf6306ab68211f10e42
-
SHA512
5df88230b8808f383a998bb90686292cd19b1f84d374408f4e1a8e169b6e4ae6974972e449b509e4257707c94835259e26f001d9e5b69ac887ef40351be316eb
-
SSDEEP
6144:saITpRGTn4f9OLoDw4UPnQR8bRVW6v/DwAiX1nXGvFdZAOX/V3WC:ypRGr4f9O+w4UP3bRTDwAyhGvFr3Xn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ac48102068a9cdc5c55a28a7f1077697_mafia_JC.exe
Files
-
ac48102068a9cdc5c55a28a7f1077697_mafia_JC.exe.exe windows x86
510021931fe53b0b1cfb31afb5a948c2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetCurrentProcessId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
IsWow64Process
GetCurrentProcess
GetVersionExW
HeapFree
HeapValidate
HeapAlloc
GetProcessHeap
LoadLibraryW
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
FlushFileBuffers
WriteFile
CreateFileW
InitializeCriticalSection
TryEnterCriticalSection
ReleaseMutex
ReadFile
GetFileSize
SetEndOfFile
SetFilePointer
GetCurrentThreadId
CreateEventW
SetEvent
DeviceIoControl
CopyFileA
TerminateProcess
DeleteFileA
GetTickCount
CreateFileA
SetLastError
UnmapViewOfFile
LocalFree
MapViewOfFile
CreateFileMappingW
CompareStringW
WriteConsoleW
CreateDirectoryW
GetLongPathNameW
RaiseException
GetProcAddress
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
lstrlenW
GetModuleFileNameW
GetModuleHandleW
DeleteCriticalSection
InterlockedDecrement
CloseHandle
InterlockedIncrement
WideCharToMultiByte
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
CreateMutexW
SetStdHandle
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetFileType
SetHandleCount
GetStdHandle
HeapCreate
IsProcessorFeaturePresent
ExitProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
GetLastError
GetWindowsDirectoryA
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
EncodePointer
DecodePointer
RtlUnwind
MoveFileW
GetSystemTimeAsFileTime
GetLocalTime
ExitThread
CreateThread
GetTimeFormatW
GetDateFormatW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
UnhandledExceptionFilter
SetEnvironmentVariableA
user32
CharNextW
advapi32
StartServiceW
RegDeleteValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
DeleteService
CreateServiceA
ControlService
OpenSCManagerW
OpenServiceA
QueryServiceStatusEx
CloseServiceHandle
RegQueryValueExW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
shell32
SHGetFolderPathW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
VarUI4FromStr
VariantClear
SysAllocString
SysAllocStringLen
SysStringLen
iuodhau
LoadIEBgWIndow
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ