Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_b9b9c5e313beda8e85c73cb2320f07f4_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_b9b9c5e313beda8e85c73cb2320f07f4_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_b9b9c5e313beda8e85c73cb2320f07f4_mafia_JC.exe
-
Size
1.4MB
-
MD5
b9b9c5e313beda8e85c73cb2320f07f4
-
SHA1
16f531399504ec3f2e144b4035cd23ddfb64b0ba
-
SHA256
f9db42ac27e71e53c961c06f9e1a65fbc97974db378d68178537bd218384a619
-
SHA512
4fbab9822d976014fe13eff4082232858303cacc1f9bc8cb6108612a1f71a935f4e9c86e8a5cf81a55e9bba0509653966ad0d542708ad76a0b9c785ee379a8fc
-
SSDEEP
12288:RXxWw4/q8oMtZp3DESimqF8umDEFt2P5cdYx6bQjO14qySz5AVWuZgmo2d+6bQXd:RB+qKuzADjOjT2mIMYKuXY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-26_b9b9c5e313beda8e85c73cb2320f07f4_mafia_JC.exe
Files
-
2023-08-26_b9b9c5e313beda8e85c73cb2320f07f4_mafia_JC.exe.exe windows:5 windows x86
9acf84d4548299e1c24cb0432ff1f525
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetCurrentDirectoryA
CloseHandle
lstrcpyA
LocalFileTimeToFileTime
FormatMessageA
InterlockedIncrement
InterlockedDecrement
QueryPerformanceCounter
Sleep
QueryPerformanceFrequency
lstrcatA
ReadFile
GetFileAttributesA
WriteFile
SetFileTime
SystemTimeToFileTime
lstrlenA
SetFilePointer
CreateFileA
DeleteFileA
GetTempPathA
CreateFileW
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
SetEndOfFile
GetDriveTypeW
HeapSize
WriteConsoleW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
FreeConsole
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
LCMapStringW
GetCurrentDirectoryW
GetFullPathNameA
SetStdHandle
GetStartupInfoW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
LoadLibraryW
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
GetModuleHandleA
WaitForSingleObject
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
GetModuleHandleW
ExitProcess
DecodePointer
HeapFree
HeapAlloc
GetCommandLineA
HeapSetInformation
EncodePointer
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
RaiseException
HeapReAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetFileInformationByHandle
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetTickCount
user32
wsprintfA
shell32
ShellExecuteA
wldap32
ord46
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord41
crypt32
CertFreeCertificateContext
ws2_32
WSACleanup
htonl
htons
ntohs
inet_addr
select
socket
__WSAFDIsSet
closesocket
WSAGetLastError
WSAStartup
getsockopt
bind
sendto
setsockopt
getsockname
ntohl
recvfrom
gethostname
ioctlsocket
send
accept
listen
connect
recv
WSAIoctl
WSASetLastError
getpeername
freeaddrinfo
getaddrinfo
gethostbyname
advapi32
CryptEncrypt
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptImportKey
Sections
.text Size: 557KB - Virtual size: 556KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ