Static task
static1
Behavioral task
behavioral1
Sample
2023-08-27_7617640db98405f8801f05c7995963ca_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-27_7617640db98405f8801f05c7995963ca_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-27_7617640db98405f8801f05c7995963ca_mafia_JC.exe
-
Size
544KB
-
MD5
7617640db98405f8801f05c7995963ca
-
SHA1
6bc3ddb15af3ed7ebbf38932a134a7c0ebe626b2
-
SHA256
deeb7afacc9c1d579065afe3c7791925afec110a60e17a44989d0d15a73fafd0
-
SHA512
ab66f813494dd37f6edf6a71beb825cbae214f659cb89ff8ef901e489ae16948f4de4cd4f9c09d725a85bd4e5337105955e8410e882b3718962bdbb25cd1b72e
-
SSDEEP
12288:M7J4J/i9+OeO+OeNhBBhhBBRH66YtoZdMXRgZ3ZfmKJVs5ycx/s3rmi2e5Sa8x9n:s9oLYtoZdMXRgZ3ZFVmxUmi2EQ9TNM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-27_7617640db98405f8801f05c7995963ca_mafia_JC.exe
Files
-
2023-08-27_7617640db98405f8801f05c7995963ca_mafia_JC.exe.exe windows:5 windows x86
086ecae0b145e5d1a637786624734f80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
ConnectNamedPipe
CreateNamedPipeA
SetLastError
GetVersionExA
CreateProcessA
GetTickCount
GetDateFormatA
CreateEventA
WaitForMultipleObjects
CreateDirectoryA
GetCommandLineA
SetConsoleCtrlHandler
LocalFree
lstrlenA
FormatMessageA
Beep
GetModuleFileNameA
OutputDebugStringA
CompareStringW
SetEndOfFile
CreateFileW
CreateFileA
SetStdHandle
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
WaitForSingleObject
GetUserDefaultLCID
GetStringTypeW
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
LoadLibraryW
GetModuleFileNameW
HeapSize
IsValidCodePage
GetOEMCP
GetACP
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCurrentThreadId
TlsFree
GetSystemDirectoryA
SetEvent
SetErrorMode
TryEnterCriticalSection
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
RemoveDirectoryA
MoveFileA
Sleep
FindNextFileA
FindClose
GetComputerNameA
GetCurrentProcess
CloseHandle
SetFileAttributesA
DeleteFileA
MoveFileExA
GlobalAlloc
GetLastError
GlobalFree
LoadLibraryA
GetProcAddress
GetLocalTime
GetLocaleInfoA
TlsSetValue
TlsGetValue
QueryPerformanceCounter
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetModuleHandleW
ExitProcess
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
IsProcessorFeaturePresent
HeapCreate
TlsAlloc
SetEnvironmentVariableA
winhttp
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
user32
GetClassNameA
GetActiveWindow
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
DestroyWindow
DefWindowProcA
IsWindow
EnumWindows
PostQuitMessage
ShowWindow
UpdateWindow
GetMessageA
DispatchMessageA
TranslateMessage
FindWindowExA
GetDC
ReleaseDC
GetWindowThreadProcessId
SendMessageA
CreateWindowExA
SetTimer
KillTimer
wsprintfA
PostMessageA
WaitForInputIdle
gdi32
GetTextExtentPoint32A
TextOutA
GetStockObject
advapi32
LogonUserA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
StartServiceCtrlDispatcherA
ControlService
QueryServiceStatus
DeleteService
CreateServiceA
SetServiceStatus
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegisterServiceCtrlHandlerA
QueryServiceStatusEx
OpenSCManagerA
OpenServiceA
CloseServiceHandle
SetTokenInformation
OpenProcessToken
DuplicateTokenEx
CreateProcessAsUserA
RevertToSelf
ImpersonateLoggedOnUser
Sections
.text Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ