Static task
static1
Behavioral task
behavioral1
Sample
2023-08-25_a1579599b078426e7547a4a1a20fac95_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-25_a1579599b078426e7547a4a1a20fac95_mafia_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2023-08-25_a1579599b078426e7547a4a1a20fac95_mafia_JC.exe
-
Size
1.3MB
-
MD5
a1579599b078426e7547a4a1a20fac95
-
SHA1
50d4995dfc79b55b85b6af03ccca77d597f1da81
-
SHA256
a6cb934c0e3ceb496703242ca009340d5503ba795f7c417e49a7a8a19222481e
-
SHA512
b264201a51ef50dc80e85ce2ea38ff32b7c966e01cf60bef77992dd9ec1f49e67a55aa659e056d1028bfaadca76effacd6a3beb1fb32ca2705a76584d8791da7
-
SSDEEP
12288:mZrPArifOqGc8dzqUeNsYJRzsPryF/PP1gh3wO6qYV3/3oOvOT0sWa:msxqs9qHBSrylP9gh3EhoVT0sW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2023-08-25_a1579599b078426e7547a4a1a20fac95_mafia_JC.exe
Files
-
2023-08-25_a1579599b078426e7547a4a1a20fac95_mafia_JC.exe.exe windows:5 windows x86
fbf7654973319c66d1e2f4ad4aad929c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathStripToRootW
PathIsUNCW
PathFileExistsW
PathAppendW
PathIsRelativeW
PathFindFileNameW
PathRemoveFileSpecW
PathRenameExtensionW
PathRemoveBackslashW
PathIsFileSpecW
PathStripPathW
comctl32
InitCommonControlsEx
kernel32
GetLocaleInfoW
GetOEMCP
GetCommandLineW
FreeLibrary
GetModuleHandleW
WideCharToMultiByte
LoadLibraryW
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameW
GetStdHandle
GetProcAddress
CloseHandle
LocalFree
GetACP
MultiByteToWideChar
GetFileSize
FindFirstFileW
SetErrorMode
MoveFileExW
CopyFileW
GetFileAttributesW
ReadFile
CreateFileW
lstrcmpW
lstrlenW
GetTempPathW
GetLastError
GetCurrentDirectoryW
SetLastError
FindClose
LocalAlloc
RemoveDirectoryW
FindNextFileW
DeleteFileW
lstrcpyW
SetFileAttributesW
CreateMutexW
ReleaseMutex
GetCurrentProcess
GetFullPathNameW
FileTimeToSystemTime
lstrcatW
FileTimeToLocalFileTime
SetFilePointer
SetFilePointerEx
WriteFile
CreateEventA
SetEvent
FlushFileBuffers
GetCurrentThreadId
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
GetFileTime
LocalFileTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
IsValidCodePage
Sleep
SetEndOfFile
UnlockFile
LockFile
GetFileAttributesA
DeleteFileA
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTime
GetSystemTimeAsFileTime
DeleteCriticalSection
LockFileEx
InterlockedIncrement
InitializeCriticalSection
GetTempPathA
FormatMessageA
GetFullPathNameA
GetDiskFreeSpaceA
GetDiskFreeSpaceW
CreateFileA
GetModuleHandleA
HeapFree
HeapAlloc
GetProcessHeap
InterlockedDecrement
HeapReAlloc
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
GetTimeZoneInformation
GetLocaleInfoA
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapCreate
HeapSize
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetEnvironmentVariableA
AreFileApisANSI
ExitProcess
SetHandleCount
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoW
HeapSetInformation
InterlockedExchange
EncodePointer
DecodePointer
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
user32
SetDlgItemTextW
LoadStringW
GetDesktopWindow
DialogBoxParamW
EndDialog
advapi32
FreeSid
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
CreateWellKnownSid
AllocateAndInitializeSid
shell32
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
SHGetPathFromIDListW
SHGetFolderLocation
CommandLineToArgvW
ord165
ShellExecuteExW
ord75
ole32
CoTaskMemFree
Sections
.text Size: 486KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 738KB - Virtual size: 737KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE