The title is somewhat badly phrased in relation to what the body asks. Because civilians can die in war without being (deliberately) targeted, aka the fabled "collateral damage".
This is certainly not the last word on the matter, but Wikipedia quotes this answer from the office of the ICC prosecutor:
Under international humanitarian law and the Rome Statute, the death of civilians during an armed
conflict, no matter how grave and regrettable, does not in itself constitute a war crime. International
humanitarian law and the Rome Statute permit belligerents to carry out proportionate attacks against
military objectives, even when it is known that some civilian deaths or injuries will occur. A crime
occurs if there is an intentional attack directed against civilians (principle of distinction) (Article
8(2)(b)(i)) or an attack is launched on a military objective in the knowledge that the incidental civilian
injuries would be clearly excessive in relation to the anticipated military advantage (principle of
proportionality) (Article 8(2)(b)(iv).
Article 8(2)(b)(iv) criminalizes:
Intentionally launching an attack in the knowledge that such attack will cause incidental loss of life
or injury to civilians or damage to civilian objects or widespread, long-term and severe damage to the
natural environment which would be clearly excessive in relation to the concrete and direct overall
military advantage anticipated;
Article 8(2)(b)(iv) draws on the principles in Article 51(5)(b) of the 1977 Additional Protocol I to the
1949 Geneva Conventions, but restricts the criminal prohibition to cases that are “clearly” excessive.
The application of Article 8(2)(b)(iv) requires, inter alia, an assessment of:
(a) the anticipated civilian damage or injury;
(b) the anticipated military advantage; and
(c) whether (a) was “clearly excessive” in relation to (b).
As you can see, there's a fair bit of room of interpretation for what are "clearly" excessive civilian casualties. Hopefully someone can illustrate this with case law.
As for hitting shopping malls... well, it depends if they are still used as such. I'm fairly reluctant to link to Russian MoD videos, but in one such one can see a military vehicle parked in front of what seems to be an office building-mall complex before it's blasted by what's probably a ballistic missile. (You can also see the aftermath in other videos; i.e. facade of the building is gone.) There's also a Wikipedia article on that strike. Now whether Russia has real-time intelligence on every target of that kind before striking it... who knows...