Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_d16e3d93f6d2acc1db85795fcabf108c_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_d16e3d93f6d2acc1db85795fcabf108c_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_d16e3d93f6d2acc1db85795fcabf108c_mafia_JC.exe
-
Size
544KB
-
MD5
d16e3d93f6d2acc1db85795fcabf108c
-
SHA1
bf9ea71816add7d8fae941fb0ddb0512dab88499
-
SHA256
58343b844f6c0910dc11ec796e3541379b4dacfec5719856b987d95d02f97f5f
-
SHA512
11c7feb3bc259b2b7adfa0cfde6b9e8be10612c6271a3ca693630008939562ceabd5509b701b431174c9baca67f36d064024d673df9f7a743f9bfadf907eac33
-
SSDEEP
12288:HmgT2/49+OeO+OeNhBBhhBBii6k8ctoZdMXRgZoCuJK4daLvGkrWbSbaZPe4x9TC:GUXP7ctoZdMXRgZoCUSGkASbg/9Tou
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-26_d16e3d93f6d2acc1db85795fcabf108c_mafia_JC.exe
Files
-
2023-08-26_d16e3d93f6d2acc1db85795fcabf108c_mafia_JC.exe.exe windows:5 windows x86
63fc7d8bee0debdad820f1932efa2095
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
WriteFile
ConnectNamedPipe
CreateNamedPipeA
CreateProcessA
GetTickCount
GetDateFormatA
CreateEventA
WaitForMultipleObjects
CreateDirectoryA
GetCommandLineA
GetVersionExA
SetConsoleCtrlHandler
LocalFree
lstrlenA
FormatMessageA
Beep
GetModuleFileNameA
OutputDebugStringA
CompareStringW
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
IsValidLocale
GetSystemDirectoryA
DeleteCriticalSection
GetUserDefaultLCID
GetStringTypeW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
GetModuleFileNameW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
SetEvent
TryEnterCriticalSection
EnumSystemLocalesA
SetErrorMode
InitializeCriticalSection
FreeLibrary
MultiByteToWideChar
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
RemoveDirectoryA
MoveFileA
Sleep
FindNextFileA
FindClose
GetComputerNameA
GetCurrentProcess
CloseHandle
SetFileAttributesA
DeleteFileA
MoveFileExA
GlobalAlloc
GetLastError
GlobalFree
LoadLibraryA
GetProcAddress
GetLocalTime
GetLocaleInfoA
SetLastError
TlsFree
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetModuleHandleW
ExitProcess
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
SetEnvironmentVariableA
winhttp
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
user32
GetClassNameA
GetActiveWindow
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
DestroyWindow
DefWindowProcA
IsWindow
EnumWindows
PostQuitMessage
ShowWindow
UpdateWindow
GetMessageA
DispatchMessageA
TranslateMessage
WaitForInputIdle
ReleaseDC
GetWindowThreadProcessId
SendMessageA
CreateWindowExA
SetTimer
KillTimer
wsprintfA
PostMessageA
GetDC
gdi32
GetTextExtentPoint32A
TextOutA
GetStockObject
advapi32
ImpersonateLoggedOnUser
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
StartServiceCtrlDispatcherA
ControlService
QueryServiceStatus
DeleteService
CreateServiceA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegisterServiceCtrlHandlerA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetTokenInformation
OpenProcessToken
DuplicateTokenEx
CreateProcessAsUserA
RevertToSelf
LogonUserA
Sections
.text Size: 349KB - Virtual size: 348KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ