Static task
static1
Behavioral task
behavioral1
Sample
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
-
Size
255KB
-
MD5
5f88e9dea36c0a29fcee359567ca68a3
-
SHA1
68f8fd802e635799166f1098ba17bd54235a7b0c
-
SHA256
06a1095054a1ab69bc13662b60f21a725d50286fabecd045f6df744b213a4c4e
-
SHA512
938b78aa7e453cd2c9352a45bf757825d00797589a568af2b415dbe9899d45cf4ab8ba535783a3d9398868fc6cbedbe11196da5d7d81c883e28bd221d181f452
-
SSDEEP
6144:o64tXafE0Mqpm+SKAqpByuqPoEbLvRdvf1:o68r0Mqpm+SCB3KbLzN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe
Files
-
2023-08-26_5f88e9dea36c0a29fcee359567ca68a3_mafia_JC.exe.exe windows:5 windows x86
887228b420011e203406ef98408b3ef0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetCurrentProcess
CreateDirectoryW
WaitForSingleObject
GetModuleHandleW
CopyFileW
GetExitCodeProcess
GetModuleFileNameW
WritePrivateProfileStringW
GetTempPathW
SetLastError
GetProcAddress
MoveFileW
GetModuleFileNameA
DeleteFileW
FindFirstFileW
OpenProcess
TerminateProcess
FindClose
Process32FirstW
RemoveDirectoryW
Sleep
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
GetProcessHeap
SetEndOfFile
HeapReAlloc
FlushFileBuffers
WriteConsoleW
IsProcessorFeaturePresent
SetStdHandle
CreateFileA
HeapSize
GetStringTypeW
RaiseException
GetCurrentProcessId
GetTickCount
Process32NextW
WideCharToMultiByte
QueryPerformanceCounter
HeapCreate
ExitProcess
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
HeapAlloc
LCMapStringW
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
WriteFile
GetStdHandle
RtlUnwind
ReadFile
GetConsoleCP
GetConsoleMode
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
CreateFileW
user32
MessageBoxW
MessageBoxA
wsprintfW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
ShellExecuteExW
ShellExecuteW
SHGetMalloc
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
HttpQueryInfoA
iphlpapi
GetAdaptersInfo
shlwapi
PathFileExistsW
PathFindFileNameW
Sections
.text Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ