Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_b8770c266c5876f18cd19e39f9f65528_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_b8770c266c5876f18cd19e39f9f65528_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-06_b8770c266c5876f18cd19e39f9f65528_mafia_JC.exe
-
Size
264KB
-
MD5
b8770c266c5876f18cd19e39f9f65528
-
SHA1
608f8e35b64e64b2c4fbacbf15f8d726a3775fe2
-
SHA256
4b1aae7365b605811383c75af1100b9b19274f25dddeacdecb2d17dbcd63ba32
-
SHA512
1f3caeaf5bc9a735b385b5552003b33f1a55de4a6f2528b6cf3023cf081503ae2477a92660b7751f8abd70c03bfd27ad3f33d0068da2da4473e28969f2c936d8
-
SSDEEP
6144:YWZP2M3eE61vokT535onXCANHljHheBf1loT:Y6PLeE61vokT535oXCANHljHoBfwT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.2023-09-06_b8770c266c5876f18cd19e39f9f65528_mafia_JC.exe
Files
-
NEAS.2023-09-06_b8770c266c5876f18cd19e39f9f65528_mafia_JC.exe.exe windows:5 windows x86
5a1d1115857a0d14ba693c23a1e4950d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteCriticalSection
LeaveCriticalSection
GetCurrentThread
OpenMutexA
CreateMutexA
GetUserDefaultUILanguage
GetCurrentThreadId
CloseHandle
DebugBreak
GetPrivateProfileSectionA
LocalUnlock
LocalLock
FreeLibrary
FormatMessageA
LoadLibraryExA
CreateTimerQueue
CreateEventA
CreateThread
DeleteTimerQueueEx
SetEvent
WaitForSingleObject
InterlockedIncrement
InterlockedCompareExchange
CreateTimerQueueTimer
DeleteTimerQueueTimer
InterlockedDecrement
ChangeTimerQueueTimer
Sleep
IsBadReadPtr
CreateNamedPipeA
ConnectNamedPipe
ReadFile
DisconnectNamedPipe
OutputDebugStringA
GetPrivateProfileStringA
WTSGetActiveConsoleSessionId
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetSystemInfo
WaitForMultipleObjects
InitializeCriticalSection
GlobalAlloc
GlobalFree
SwitchToThread
SetStdHandle
WriteConsoleW
LoadLibraryW
HeapReAlloc
EnterCriticalSection
WriteFile
SetCurrentDirectoryA
GetModuleFileNameA
GetLastError
CreateDirectoryA
SetEndOfFile
SetFilePointer
CreateFileA
GetLocalTime
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
CreateFileW
QueryPerformanceCounter
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
HeapCreate
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
CreateIoCompletionPort
InterlockedExchange
GetACP
ExitProcess
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
HeapFree
ExitThread
HeapAlloc
GetCommandLineA
HeapSetInformation
RaiseException
RtlUnwind
GetCPInfo
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapSize
GetProcAddress
GetModuleHandleW
user32
PostThreadMessageA
GetMessageA
PeekMessageA
MessageBoxA
advapi32
RegisterServiceCtrlHandlerA
OpenSCManagerA
SetServiceStatus
CreateServiceA
OpenServiceA
ChangeServiceConfig2A
DeleteService
StartServiceCtrlDispatcherA
CloseServiceHandle
ws2_32
WSAIoctl
WSARecv
WSASend
shutdown
WSASocketA
WSAStartup
listen
bind
closesocket
connect
socket
sendto
recvfrom
ioctlsocket
ntohs
ntohl
htons
htonl
inet_addr
inet_ntoa
getpeername
setsockopt
WSAGetLastError
WSACleanup
shlwapi
PathRemoveFileSpecA
PathFileExistsA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
iphlpapi
GetIpAddrTable
wtsapi32
WTSSendMessageA
Sections
.text Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ