Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_fb288aa09ec68306beb7ad88cd5b7c5e_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_fb288aa09ec68306beb7ad88cd5b7c5e_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_fb288aa09ec68306beb7ad88cd5b7c5e_mafia_JC.exe
-
Size
249KB
-
MD5
fb288aa09ec68306beb7ad88cd5b7c5e
-
SHA1
ff6a281872ed0919b51350fff1610796829f3727
-
SHA256
d1d03c914b7d730bf7322c15719ea58399af3262e8cf4da6ef6f3adf9418696a
-
SHA512
a1b28eda60d099cc669c289a87f1bdfa2d012783ce5a931799091efeb018e6a5bcf8fcfaa08e713f3d840f71ff2256422f85246d0c86394c42875e45df68926e
-
SSDEEP
6144:2V3PdK+6lTabaSWfeqDnQdFDEGqXPFjP7AGDzLvp8:C3PdK+WuajHDyFDEGqXPFP7z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-26_fb288aa09ec68306beb7ad88cd5b7c5e_mafia_JC.exe
Files
-
2023-08-26_fb288aa09ec68306beb7ad88cd5b7c5e_mafia_JC.exe.exe windows:5 windows x86
e09d325dc9fd6f3898434f8292de2b2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExpandEnvironmentStringsW
InitializeCriticalSection
GetCurrentProcessId
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetTickCount
CreateFileW
Sleep
SetFilePointer
WriteFile
CloseHandle
OutputDebugStringW
GetCurrentThreadId
QueryPerformanceCounter
OpenProcess
GetFileAttributesExW
GetTempFileNameW
GetLongPathNameW
SearchPathW
FormatMessageW
LocalFree
CreateMutexW
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
ReleaseMutex
UnmapViewOfFile
SetLastError
QueryPerformanceFrequency
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetEnvironmentVariableW
GetCurrentProcess
WideCharToMultiByte
GetPrivateProfileStringW
GetPrivateProfileStringA
WritePrivateProfileStringW
WritePrivateProfileStringA
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
HeapFree
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
RaiseException
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetModuleHandleW
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
GetTimeZoneInformation
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
WriteConsoleW
SetStdHandle
CompareStringW
SetEnvironmentVariableA
GetLastError
ExitThread
GetProcAddress
LoadLibraryW
FreeLibrary
InterlockedCompareExchange
GetCommandLineW
SetFileAttributesW
CopyFileW
MoveFileExW
GetSystemDirectoryW
DeviceIoControl
GetFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
ProcessIdToSessionId
GlobalAlloc
LocalAlloc
GetUserDefaultLangID
SetCurrentDirectoryW
GetCurrentDirectoryW
GetVersionExW
CreateProcessW
GetTempPathW
GetDiskFreeSpaceExW
CreateThread
GetExitCodeThread
GetExitCodeProcess
TerminateThread
CreateEventW
OpenEventW
ResetEvent
SetEvent
GetLocalTime
GetSystemTime
OpenMutexW
GetShortPathNameW
GetFileSizeEx
PeekNamedPipe
TryEnterCriticalSection
WaitForMultipleObjects
CreatePipe
GlobalMemoryStatusEx
OpenFileMappingW
FlushViewOfFile
GetSystemDefaultLCID
GetSystemDefaultUILanguage
DeleteFileW
GetComputerNameExW
shlwapi
PathIsFileSpecW
PathFindFileNameW
PathRemoveFileSpecW
PathFindExtensionW
psapi
EnumProcessModules
GetModuleFileNameExW
GetModuleBaseNameW
EnumProcesses
user32
WaitForInputIdle
GetAsyncKeyState
OpenWindowStationW
CloseWindowStation
GetProcessWindowStation
SetProcessWindowStation
GetThreadDesktop
MsgWaitForMultipleObjectsEx
OpenDesktopW
CloseDesktop
ExitWindowsEx
AllowSetForegroundWindow
PeekMessageW
MsgWaitForMultipleObjects
GetSystemMetrics
SystemParametersInfoW
LoadIconW
DestroyIcon
RegisterWindowMessageW
SetTimer
GetMessageW
SendMessageCallbackW
GetKeyState
SetThreadDesktop
advapi32
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
GetUserNameW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegDeleteKeyW
CheckTokenMembership
OpenProcessToken
RegQueryValueExW
shell32
ExtractIconW
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
ole32
CoUninitialize
CoInitialize
CLSIDFromString
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
secur32
GetUserNameExW
Sections
.text Size: 141KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ