Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_945289e35c849d42380ffbe2dcd4f0cf_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_945289e35c849d42380ffbe2dcd4f0cf_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_945289e35c849d42380ffbe2dcd4f0cf_mafia_JC.exe
-
Size
2.2MB
-
MD5
945289e35c849d42380ffbe2dcd4f0cf
-
SHA1
64bc4c815273d89cc46b64fbb0877f1ec0bcb939
-
SHA256
4d9fabb594ce02c6cea1ab9aa0a01467df4c45d13be05f5d326ca4f49213773d
-
SHA512
bb0ff5f443796e1c4779ae63831ea368655ab87f8abcaa3e2efeb3d876853043b89fbc29c1192eab3cbbbd09dcc60d533358c6bf25fb4a4a8acf37290aad601e
-
SSDEEP
49152:+WqTDhzwDZ3brb6mkD5ZVk5HJYyxzT88dDRikvHOxt67o9inGaOtZT:7DZLrb6j/VkDY6xDRik
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-22_945289e35c849d42380ffbe2dcd4f0cf_mafia_JC.exe
Files
-
2023-08-22_945289e35c849d42380ffbe2dcd4f0cf_mafia_JC.exe.exe windows x86
aa0df6849577b986d944a863b84b2739
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
CloseHandle
GetThreadTimes
QueryPerformanceFrequency
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DeleteCriticalSection
GetCurrentThreadId
Sleep
InterlockedDecrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SetEvent
SetEnvironmentVariableA
CompareStringW
LoadLibraryW
GetProcAddress
FreeLibrary
OpenProcess
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
LoadLibraryA
CreateProcessW
ExitProcess
MultiByteToWideChar
GetModuleFileNameW
GetCurrentProcess
IsWow64Process
VirtualQuery
TerminateProcess
WaitForMultipleObjects
CreateEventW
CreateThread
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
GetVersion
CreateFileW
SetFilePointer
WideCharToMultiByte
WriteFile
GetFileSize
CopyFileW
InterlockedIncrement
CompareFileTime
GetModuleHandleW
LocalFree
FormatMessageW
lstrlenW
LocalAlloc
SetLastError
OutputDebugStringW
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrlenA
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
InitializeCriticalSection
EncodePointer
DecodePointer
FormatMessageA
WriteConsoleW
GetFileType
GetStdHandle
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
RtlUnwind
GetCPInfo
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
HeapCreate
QueryPerformanceCounter
GetTickCount
GetACP
GetOEMCP
IsValidCodePage
IsProcessorFeaturePresent
GetTimeZoneInformation
HeapQueryInformation
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
SizeofResource
user32
GetWindowThreadProcessId
PostThreadMessageW
FindWindowW
ole32
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
oleaut32
SysStringLen
CreateErrorInfo
SetErrorInfo
SysStringByteLen
SysFreeString
SysAllocString
GetErrorInfo
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
shlwapi
PathAppendW
rpcrt4
UuidToStringW
RpcStringFreeW
psapi
GetModuleBaseNameA
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
advapi32
CryptGenRandom
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
DuplicateTokenEx
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
CryptAcquireContextA
CryptReleaseContext
LookupPrivilegeValueW
shell32
SHGetFolderPathW
SHFileOperationW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 393KB - Virtual size: 392KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ