Static task
static1
Behavioral task
behavioral1
Sample
d9f639fd3b3d8a2b8fdac9149d780c2d_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d9f639fd3b3d8a2b8fdac9149d780c2d_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
d9f639fd3b3d8a2b8fdac9149d780c2d_mafia_JC.exe
-
Size
294KB
-
MD5
d9f639fd3b3d8a2b8fdac9149d780c2d
-
SHA1
f8522592157e15277eb63be119619cd5ba8012ca
-
SHA256
5653ba52dbc7ec4110cea53af73e03ead68143f093dbf3a44af85532c21a54c9
-
SHA512
f54d300ca88862a1cfa9cb292142b973111d4ca2685d3ac1197cf6fd9d04ca4326d8ffd9b3d0bb9ffc0d370b499db2f53acd5be5391f6308d5cc0b8784dbdead
-
SSDEEP
6144:6vSgnk/NgSJqzhUU2fa1WKXIOTzjELEJa:ESpJShU80XOTUua
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d9f639fd3b3d8a2b8fdac9149d780c2d_mafia_JC.exe
Files
-
d9f639fd3b3d8a2b8fdac9149d780c2d_mafia_JC.exe.exe windows x86
8789b700fb185b521d8c4230c8ca90ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
FindActCtxSectionStringW
SetVolumeMountPointA
GetProcAddress
LoadLibraryW
GetQueuedCompletionStatus
GlobalDeleteAtom
GetCPInfoExA
lstrlenA
WriteConsoleW
ReadFile
GetProcessHeap
SetEndOfFile
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
Sleep
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
RtlUnwind
RaiseException
GetLastError
HeapFree
GetCommandLineW
HeapSetInformation
GetStartupInfoW
HeapAlloc
LCMapStringW
GetCPInfo
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
CloseHandle
CreateFileA
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
CreateFileW
user32
GetPropW
ole32
CoGetCurrentProcess
Sections
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ