Static task
static1
Behavioral task
behavioral1
Sample
ae26ce7445513272885d021548ea5c5c_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ae26ce7445513272885d021548ea5c5c_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
ae26ce7445513272885d021548ea5c5c_mafia_JC.exe
-
Size
801KB
-
MD5
ae26ce7445513272885d021548ea5c5c
-
SHA1
a6ed4a552fedf81e686e19ec020812ffae9b7ae5
-
SHA256
df28251df089593a4d38ce9495a869af9aebc8fea35469fecee94f1e3e41c043
-
SHA512
1a82531824bf8a176e0ff3ee780d632a0d8bed8be045c14b04e726251f63dd1a15ab445b92d97360981c722d07b9fe9c952d96ad7b46ba1c71c109c224b520d9
-
SSDEEP
24576:xeLcOe8KEbDl+M59u9M1OmGVCEyXRKL8B2VrMU1S:4LPjl+M59u9YhGUI2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae26ce7445513272885d021548ea5c5c_mafia_JC.exe
Files
-
ae26ce7445513272885d021548ea5c5c_mafia_JC.exe.exe windows x86
8a31212e11e4ad7b3207427260234e51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
LocalFree
GetTickCount
FreeLibrary
SetEvent
LoadLibraryW
ExitThread
GetLastError
GetProcAddress
ResetEvent
CreateEventW
CreateThread
WaitForMultipleObjects
GetTempPathA
DeleteFileA
lstrlenA
lstrcpynA
GetVersionExW
lstrcpynW
FlushInstructionCache
SetLastError
GetCurrentThreadId
FindResourceW
LoadResource
MultiByteToWideChar
LockResource
InterlockedExchange
GetLocalTime
VirtualQuery
SetUnhandledExceptionFilter
IsBadReadPtr
GetModuleFileNameA
GetCurrentProcessId
FindFirstFileW
GetModuleFileNameW
FindClose
FindNextFileW
GetModuleHandleW
GetSystemTime
lstrcatA
CreateMutexW
ReadFile
OpenMutexW
SetFileAttributesA
ExitProcess
DeleteCriticalSection
UnhandledExceptionFilter
EnterCriticalSection
LCMapStringW
RtlUnwind
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapReAlloc
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
DecodePointer
EncodePointer
GetStringTypeW
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
SetHandleCount
GetStdHandle
GetFileType
HeapCreate
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
HeapSize
SetStdHandle
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
RemoveDirectoryW
LocalAlloc
IsValidLocale
WriteConsoleW
SetEndOfFile
GetTempPathW
LeaveCriticalSection
InitializeCriticalSection
IsDebuggerPresent
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetFileAttributesW
GetFileAttributesA
ResumeThread
SuspendThread
GetExitCodeThread
RaiseException
Sleep
TerminateThread
WaitForSingleObject
SetThreadContext
GetThreadContext
CloseHandle
CreateFileW
WriteFile
CreateFileA
lstrlenW
TerminateProcess
WideCharToMultiByte
user32
GetWindowRect
MonitorFromPoint
wvsprintfW
DialogBoxParamW
GetParent
MessageBeep
TranslateAcceleratorW
SendDlgItemMessageW
EndDialog
GetFocus
GetSystemMetrics
SendMessageA
GetClientRect
SetFocus
GetMenuItemInfoW
PtInRect
GetClassInfoExW
LoadAcceleratorsW
IsDialogMessageW
GetWindowTextA
TrackPopupMenuEx
LoadMenuW
GetWindowLongW
AppendMenuW
PeekMessageW
MonitorFromWindow
GetDlgItem
SetWindowLongW
GetActiveWindow
wsprintfW
SetWindowPos
LoadStringW
ShowWindow
CreateDialogParamW
GetMenuItemCount
IsWindow
RemoveMenu
SetMenuDefaultItem
MessageBoxW
IsWindowVisible
SetWindowTextA
MapWindowPoints
EnableWindow
SetWindowTextW
SetMenuItemInfoW
GetMonitorInfoW
CallWindowProcW
EnumDisplayDevicesW
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
GetWindow
DestroyWindow
SendNotifyMessageW
GetMessageW
PostQuitMessage
TrackPopupMenu
LoadImageW
SetForegroundWindow
LoadCursorW
TranslateMessage
RegisterClassExW
GetCursorPos
CreatePopupMenu
CreateWindowExW
InsertMenuW
DestroyMenu
DestroyIcon
DefWindowProcW
DispatchMessageW
SetTimer
PostMessageW
KillTimer
SendMessageW
LoadStringA
UnregisterClassA
gdi32
GetDeviceCaps
CreateDCW
DeleteDC
DeleteObject
CreateFontIndirectW
advapi32
GetTokenInformation
RegEnumValueW
RegQueryValueExW
RegDeleteValueA
RegSetValueExA
RegCloseKey
RegOpenKeyExW
OpenProcessToken
RegQueryValueExA
shell32
Shell_NotifyIconW
Shell_NotifyIconA
SHGetSpecialFolderPathA
ShellExecuteExA
SHGetSpecialFolderPathW
ole32
CoInitialize
CoUninitialize
iphlpapi
GetAdaptersInfo
wininet
HttpQueryInfoA
InternetReadFile
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersA
HttpSendRequestA
InternetCloseHandle
InternetOpenUrlA
InternetOpenW
psapi
EnumProcessModules
GetModuleInformation
GetModuleFileNameExA
ws2_32
htons
WSAEventSelect
WSAEnumNetworkEvents
closesocket
gethostbyname
WSAWaitForMultipleEvents
WSAConnect
WSAGetLastError
WSASend
WSASocketW
WSARecv
inet_addr
ioctlsocket
WSACloseEvent
WSAStartup
WSACreateEvent
setupapi
SetupDiGetClassDevsExW
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDevRegKey
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
Sections
.text Size: 410KB - Virtual size: 410KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ