Static task
static1
Behavioral task
behavioral1
Sample
2023-08-23_2ed50b4379b4e7c0cf34f88ddc3a4837_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-23_2ed50b4379b4e7c0cf34f88ddc3a4837_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-23_2ed50b4379b4e7c0cf34f88ddc3a4837_mafia_JC.exe
-
Size
495KB
-
MD5
2ed50b4379b4e7c0cf34f88ddc3a4837
-
SHA1
87ad5c770cf619da953ed0990f9a1fcef369a1bf
-
SHA256
5502547ebce5648c5dab3545e680809b69d96f44adf168510de589511ad75f84
-
SHA512
ffe73928f3d26e576039ac3d8ab3084a5ed77a81ff2bf5a8a227be3549c5a7d0714969a0c69125cbde1377ba83913518c5e0a3f47e5fca22f5536c5677aeb5da
-
SSDEEP
12288:qrtMMRnyrEl9KiJ61cgjCYoRyKAcWNnZxRXbEvJcpW:qxMMRnyrEl9JAcgjUyKAcAZ/XYxcpW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-23_2ed50b4379b4e7c0cf34f88ddc3a4837_mafia_JC.exe
Files
-
2023-08-23_2ed50b4379b4e7c0cf34f88ddc3a4837_mafia_JC.exe.exe windows x86
c230e48642de20f74e54d6a147ab4f39
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
utilities
??B?$TStringT@DUchar_traits@SOUI@@@SOUI@@QBEPBDXZ
?STraceA@SOUI@@YAXPBDZZ
?Right@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@H@Z
?Left@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBE?AV12@H@Z
?Find@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEH_WH@Z
?Append@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEABV12@ABV12@@Z
?Trim@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV12@_W@Z
?Insert@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEHHPB_W@Z
?Format@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAA?AV12@PB_WZZ
?child@xml_node@pugi@@QBE?AV12@PB_W_N@Z
??1xml_document@pugi@@QAE@XZ
??0xml_document@pugi@@QAE@XZ
?ConcatCopy@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IAE_NHPB_WH0@Z
?SafeStrlen@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@SAHPB_W@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
?GetBuffer@?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAEPADH@Z
??Y?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEABV01@PB_W@Z
??Y?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEABV01@ABV01@@Z
?Compare@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHPB_W@Z
?GetLength@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEHXZ
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@ABV01@@Z
??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV01@ABV01@@Z
??4?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAEAAV01@PB_W@Z
??0?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@PB_W@Z
?CvtW2A@SStrCpCvt@SOUI@@SA?AV?$TStringT@DUchar_traits@SOUI@@@2@ABV?$TStringT@_WUwchar_traits@SOUI@@@2@I@Z
?GetData@?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@IBEPAUTStringData@2@XZ
??1?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QAE@XZ
??1?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@XZ
??0?$TStringT@DUchar_traits@SOUI@@@SOUI@@QAE@PBD@Z
?CvtA2W@SStrCpCvt@SOUI@@SA?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV?$TStringT@DUchar_traits@SOUI@@@2@II@Z
??B?$TStringT@_WUwchar_traits@SOUI@@@SOUI@@QBEPB_WXZ
soui
?DrawTextW@SWindow@SOUI@@UAEXPAUIRenderTarget@2@PB_WHPAUtagRECT@@I@Z
?DrawFocus@SWindow@SOUI@@UAEXPAUIRenderTarget@2@@Z
?BeforePaint@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@AAVSPainter@2@@Z
?AfterPaint@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@AAVSPainter@2@@Z
?CreateCaret@SWindow@SOUI@@UAEHPAUHBITMAP__@@HH@Z
?ShowCaret@SWindow@SOUI@@UAEXH@Z
?SetCaretPos@SWindow@SOUI@@UAEXHH@Z
?IsDrawToCache@SWindow@SOUI@@MBE_NXZ
?IsLayeredWindow@SHostWnd@SOUI@@MBEHXZ
?SwndProc@SWindow@SOUI@@MAEHIIJAAJ@Z
?ProcessSwndMessage@SWindow@SOUI@@MAEHIIJAAJ@Z
?AddRef@?$TObjRefImpl@UIObjRef@@@SOUI@@UAEJXZ
?Release@?$TObjRefImpl@UIObjRef@@@SOUI@@UAEJXZ
?OnFinalRelease@?$TObjRefImpl2@UIObjRef@@VSWindow@SOUI@@@SOUI@@UAEXXZ
?GetID@SWindow@SOUI@@UBEHXZ
?OnFinalMessage@CSimpleWnd@SOUI@@MAEXPAUHWND__@@@Z
??1SMessageBoxImpl@SOUI@@UAE@XZ
?SetTimer@SHostWnd@SOUI@@QAEIII@Z
?KillTimer@SHostWnd@SOUI@@QAEHI@Z
?IsDescendant@SWindow@SOUI@@QBEHPBV12@@Z
?_HandleEvent@SHostWnd@SOUI@@UAEHPAVEventArgs@2@@Z
?ProcessWindowMessage@SHostWnd@SOUI@@UAEHPAUHWND__@@IIJAAJK@Z
?ReflectNotifications@CSimpleWnd@SOUI@@QAEJIIJAAH@Z
??0SHostWnd@SOUI@@QAE@PB_W@Z
??1SHostWnd@SOUI@@UAE@XZ
?GetCurSel@STabCtrl@SOUI@@QAEHXZ
?DestroyWindow@CSimpleWnd@SOUI@@QAEHXZ
?GetSkin@SSkinPoolMgr@SOUI@@QAEPAVISkinObj@2@PB_W@Z
?getSingleton@?$SSingleton@VSSkinPoolMgr@SOUI@@@SOUI@@SAAAVSSkinPoolMgr@2@XZ
?getSingleton@?$SSingleton@VSApplication@SOUI@@@SOUI@@SAAAVSApplication@2@XZ
?EnableWindow@SWindow@SOUI@@QAEXHH@Z
?SetCurSel@STabCtrl@SOUI@@QAEHH@Z
?SetValue@SProgress@SOUI@@QAEHH@Z
??0EventCmd@SOUI@@QAE@PAVSObject@1@@Z
??1?$TplEventArgs@VEventCmd@SOUI@@@SOUI@@UAE@XZ
??1EventArgs@SOUI@@UAE@XZ
??1?$TObjRefImpl@UIObjRef@@@SOUI@@UAE@XZ
??_7?$TObjRefImpl@UIObjRef@@@SOUI@@6B@
??1SObject@SOUI@@UAE@XZ
??_7SObject@SOUI@@6B@
??_7EventArgs@SOUI@@6B?$TObjRefImpl@UIObjRef@@@1@@
??_7EventArgs@SOUI@@6BSObject@1@@
??1EventCmd@SOUI@@UAE@XZ
?GetLayout@SWindow@SOUI@@UAEPAVSwndLayout@2@XZ
?GetClassNameW@SWindow@SOUI@@SAPB_WXZ
?GetClassNameW@SStatic@SOUI@@SAPB_WXZ
?GetLogManager@SApplication@SOUI@@QAEPAUILog4zManager@2@XZ
?GetClassNameW@SSkinImgList@SOUI@@SAPB_WXZ
?GetClassNameW@STabCtrl@SOUI@@SAPB_WXZ
?GetClassNameW@SButton@SOUI@@SAPB_WXZ
?GetClassNameW@SProgress@SOUI@@SAPB_WXZ
?GetClassNameW@SSliderBar@SOUI@@SAPB_WXZ
?GetTextRect@SWindow@SOUI@@UAEXPAUtagRECT@@@Z
?IsClass@SHostWnd@SOUI@@UAEHPB_W@Z
?GetObjectClass@SHostWnd@SOUI@@UAEPB_WXZ
?SetCheck@SWindow@SOUI@@QAEXH@Z
?IsChecked@SWindow@SOUI@@QAEHXZ
?GetClassNameW@SEdit@SOUI@@SAPB_WXZ
?GetClassNameW@SCheckBox@SOUI@@SAPB_WXZ
?GetClassNameW@EventRENotify@SOUI@@SAPB_WXZ
?tr@SWindow@SOUI@@UAE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@ABV32@@Z
?DefAttributeProc@SWindow@SOUI@@MAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?AfterAttribute@SWindow@SOUI@@MAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0J@Z
?SetAttribute@SWindow@SOUI@@UAEJABV?$TStringT@_WUwchar_traits@SOUI@@@2@0H@Z
?InitFromXml@SHostWnd@SOUI@@UAEHVxml_node@pugi@@@Z
?GetObjectClass@SHostDialog@SOUI@@UAEPB_WXZ
?IsClass@SHostDialog@SOUI@@UAEHPB_W@Z
?OnGetButtonText@SMessageBoxImpl@SOUI@@MBE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@H@Z
?DoModal@SHostDialog@SOUI@@UAEHPAUHWND__@@@Z
?EndDialog@SHostDialog@SOUI@@UAEXH@Z
?_HandleEvent@SMessageBoxImpl@SOUI@@UAEHPAVEventArgs@2@@Z
?DoFrameEvent@SwndContainerImpl@SOUI@@MAEJIIJ@Z
?GetScriptModule@SHostWnd@SOUI@@MAEPAUIScriptModule@2@XZ
?BuildWndTreeZorder@SwndContainerImpl@SOUI@@MAEXXZ
?MarkWndTreeZorderDirty@SwndContainerImpl@SOUI@@MAEXXZ
?GetMsgLoop@SHostDialog@SOUI@@MAEPAVSMessageLoop@2@XZ
?UnregisterTrackMouseEvent@SwndContainerImpl@SOUI@@MAEHK@Z
?RegisterTrackMouseEvent@SwndContainerImpl@SOUI@@MAEHK@Z
?UnregisterTimelineHandler@SHostWnd@SOUI@@MAEHPAUITimelineHandler@2@@Z
?RegisterTimelineHandler@SHostWnd@SOUI@@MAEHPAUITimelineHandler@2@@Z
?GetAcceleratorMgr@SwndContainerImpl@SOUI@@MAEPAUIAcceleratorMgr@2@XZ
?FrameToHost@SwndContainerImpl@SOUI@@MAEXAAUtagRECT@@@Z
?GetChildrenLayoutRect@SWindow@SOUI@@UAE?AVCRect@2@XZ
?OnRelayout@SWindow@SOUI@@UAEXABVCRect@2@0@Z
?OnUpdateFloatPosition@SWindow@SOUI@@UAEXABVCRect@2@@Z
?UpdateChildrenPosition@SWindow@SOUI@@UAEXXZ
?IsClipClient@SWindow@SOUI@@UAEHXZ
?OnNcHitTest@SWindow@SOUI@@UAEHVCPoint@2@@Z
?IsFocusable@SWindow@SOUI@@UAEHXZ
?OnGetDlgCode@SWindow@SOUI@@UAEIXZ
?FireEvent@SWindow@SOUI@@UAEHAAVEventArgs@2@@Z
?SwndFromPoint@SWindow@SOUI@@UAEKVCPoint@2@H@Z
?UpdateLayout@SWindow@SOUI@@UAEXXZ
?RequestRelayout@SHostWnd@SOUI@@UAEXPAVSWindow@2@@Z
?OnStateChanged@SWindow@SOUI@@UAEXKK@Z
?OnStateChanging@SWindow@SOUI@@UAEXKK@Z
?OnUpdateToolTip@SWindow@SOUI@@UAEHVCPoint@2@AAUSwndToolTipInfo@2@@Z
?OnSetCursor@SWindow@SOUI@@UAEHABVCPoint@2@@Z
?UpdateTooltip@SHostWnd@SOUI@@MAEXXZ
?UpdateWindow@SHostWnd@SOUI@@MAEHXZ
?OnSetCaretPos@SHostWnd@SOUI@@MAEHHH@Z
?OnShowCaret@SHostWnd@SOUI@@MAEHH@Z
?GetSelectedChildInGroup@SWindow@SOUI@@UAEPAV12@XZ
?GetSelectedSiblingInGroup@SWindow@SOUI@@UAEPAV12@XZ
?IsSiblingsAutoGroupped@SWindow@SOUI@@UAEHXZ
?NeedRedrawWhenStateChange@SWindow@SOUI@@UAEHXZ
?GetMsgLoop@SHostWnd@SOUI@@MAEPAVSMessageLoop@2@XZ
?GetDesiredSize@SWindow@SOUI@@UAE?AVCSize@2@PBUtagRECT@@@Z
?CreateChildren@SWindow@SOUI@@UAEHVxml_node@pugi@@@Z
?OnColorize@SWindow@SOUI@@MAEXK@Z
?IsContainPoint@SWindow@SOUI@@UBEHABUtagPOINT@@H@Z
?GetClientRect@SWindow@SOUI@@UBEXPAUtagRECT@@@Z
?GetClientRect@SHostWnd@SOUI@@UBE?AVCRect@2@XZ
?SetWindowTextW@SWindow@SOUI@@UAEXPB_W@Z
?GetWindowTextW@SWindow@SOUI@@UAE?AV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ
?OnInitFinished@SObject@SOUI@@MAEXVxml_node@pugi@@@Z
?GetValue@SProgress@SOUI@@QAEHXZ
?GetName@SWindow@SOUI@@UBEPB_WXZ
?OnCreateCaret@SHostWnd@SOUI@@MAEHKPAUHBITMAP__@@HH@Z
?GetFocus@SwndContainerImpl@SOUI@@MAEKXZ
?GetHover@SwndContainerImpl@SOUI@@MAEKXZ
?OnSetSwndFocus@SwndContainerImpl@SOUI@@MAEXK@Z
?OnSetSwndCapture@SHostWnd@SOUI@@MAEKK@Z
?OnReleaseSwndCapture@SHostWnd@SOUI@@MAEHXZ
?OnGetSwndCapture@SwndContainerImpl@SOUI@@MAEKXZ
?OnRedraw@SHostWnd@SOUI@@MAEXABVCRect@2@@Z
?OnReleaseRenderTarget@SHostWnd@SOUI@@MAEXPAUIRenderTarget@2@ABVCRect@2@K@Z
?OnGetRenderTarget@SHostWnd@SOUI@@MAEPAUIRenderTarget@2@ABVCRect@2@K@Z
?GetContainerRect@SHostWnd@SOUI@@MAE?AVCRect@2@XZ
?IsSendWheel2Hover@SHostWnd@SOUI@@MBEHXZ
?IsTranslucent@SHostWnd@SOUI@@MBEHXZ
?GetTranslatorContext@SHostWnd@SOUI@@MAEABV?$TStringT@_WUwchar_traits@SOUI@@@2@XZ
?GetHostHwnd@SHostWnd@SOUI@@MAEPAUHWND__@@XZ
?OnFireEvent@SHostWnd@SOUI@@MAEHAAVEventArgs@2@@Z
?RevokeDragDrop@SwndContainerImpl@SOUI@@MAEHK@Z
?RegisterDragDrop@SwndContainerImpl@SOUI@@MAEHKPAUIDropTarget@@@Z
?OnNextFrame@SwndContainerImpl@SOUI@@UAEXXZ
??0SMessageBoxImpl@SOUI@@QAE@XZ
?MessageBoxW@SMessageBoxImpl@SOUI@@QAEHPAUHWND__@@PB_W1I@Z
?IsVisible@SWindow@SOUI@@QAEHH@Z
?FindChildByID@SWindow@SOUI@@QAEPAV12@HH@Z
?SetVisible@SWindow@SOUI@@QAEXHH@Z
?FindChildByName@SWindow@SOUI@@QAEPAV12@PB_WH@Z
??1SApplication@SOUI@@UAE@XZ
?Run@SApplication@SOUI@@QAEHPAUHWND__@@@Z
?ShowWindow@CSimpleWnd@SOUI@@QAEHH@Z
?CenterWindow@CSimpleWnd@SOUI@@QAEHPAUHWND__@@@Z
?SendMessageW@CSimpleWnd@SOUI@@QAEJIIJ@Z
?Create@SHostWnd@SOUI@@QAEPAUHWND__@@PAU3@HHHH@Z
?SMessageBox@SOUI@@YAHPAUHWND__@@PB_W1I@Z
?SetMsgTemplate@SOUI@@YAHVxml_node@pugi@@@Z
?LoadXmlDocment@SApplication@SOUI@@QAEHAAVxml_document@pugi@@PB_W1@Z
?AddResProvider@SResProviderMgr@SOUI@@QAEXPAUIResProvider@2@PB_W@Z
?InitXmlNamedID@SApplication@SOUI@@QAEXPBU?$TNAMEDVALUE@H@2@HH@Z
?LoadSystemNamedResource@SApplication@SOUI@@QAEIPAUIResProvider@2@@Z
?CreateResProvider@SOUI@@YAHW4BUILTIN_RESTYPE@1@PAPAUIObjRef@@@Z
??0SApplication@SOUI@@QAE@PAUIRenderFactory@1@PAUHINSTANCE__@@PB_W@Z
?ProcessWindowMessage@SMessageBoxImpl@SOUI@@UAEHPAUHWND__@@IIJAAJK@Z
kernel32
WriteConsoleW
CreateFileW
SetConsoleCtrlHandler
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetCurrentThread
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
FatalAppExitA
HeapCreate
ReadFile
SetFilePointer
GetFileType
GetStdHandle
SetStdHandle
GetConsoleMode
GetConsoleCP
WriteFile
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleW
HeapSize
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
LCMapStringW
HeapAlloc
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineW
HeapFree
MoveFileA
DeleteFileA
InterlockedCompareExchange
DecodePointer
EncodePointer
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
CreateFileA
SetEndOfFile
SetHandleCount
GetProcessHeap
FindClose
FindFirstFileW
WinExec
MultiByteToWideChar
GetLastError
WideCharToMultiByte
SystemTimeToFileTime
GetLocalTime
GetFileAttributesW
GetCurrentProcess
LoadLibraryW
GetProcAddress
SetCurrentDirectoryW
GetModuleFileNameW
FreeLibrary
Sleep
CloseHandle
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
HeapDestroy
user32
GetDlgCtrlID
GetWindowTextW
RemovePropW
GetDlgItem
EndDialog
GetPropW
CharLowerW
MessageBoxW
GetActiveWindow
SendMessageW
SetWindowLongW
GetParent
SetPropW
CallWindowProcW
SetWindowTextW
comdlg32
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetPathFromIDListA
ole32
OleInitialize
OleUninitialize
shlwapi
PathFindExtensionW
wininet
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW
winmm
mciGetErrorStringW
mciSendCommandW
Sections
.text Size: 315KB - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ