2024-05-17_e4c94213eca85b6ded0d8a9c149b963c_mafia

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-17_e4c94213eca85b6ded0d8a9c149b963c_mafia
Size

183KB
MD5

e4c94213eca85b6ded0d8a9c149b963c
SHA1

7fef4e8aae83850c7aae72565a548c46e7edba46
SHA256

1fa2e104d8a4523d306f6afdc5af70df9eaaaaeb638d9588068219b9de8148d0
SHA512

730f7edf608a0e44315318dabc7106fc0a3495c13a95474a2052c3975b9af7602143e52e84a27026bd4aede0cac1d5f28ab3b802a0dc103c84def72d356e678d
SSDEEP

3072:ryfNRmD+H2m+Z1onSHxQmbhDZPiTBsFJ/DsXNuKT/zFpn:ry1EDQz+Z1onEr/EuFls9Hnj

Score

1^/10

Malware Config

Signatures

Files

2024-05-17_e4c94213eca85b6ded0d8a9c149b963c_mafia
.exe windows:5 windows x86 arch:x86

d2bdeaf2e6339b479c121acc3c45e3ff

Code Sign

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/12/2017, 00:00

Not After

10/12/2020, 23:59

Subject

CN=ZOHO Corporation private Limited,OU=ZOHO / ManageEngine,O=ZOHO Corporation private Limited,POSTALCODE=603202,STREET=Estancia IT Park \, Plot No. 140 & 151\, GST Road\, Vallancherry Village\, Kanchipuram\, District\,,L=Chennai,ST=Tamilnadu,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:0a:b6:d7:e4:c4:6c:0a:52:61:ee:95:04:ef:b0:60:d3:4e:91:b8
Signer

Actual PE Digest

d0:0a:b6:d7:e4:c4:6c:0a:52:61:ee:95:04:ef:b0:60:d3:4e:91:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\File_Transfer\15-Jun-20\desktopcentral\3171074\ONPREMISE\SA_SRC\native\agent\Release\dcremagentinstaller.pdb

Imports

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

CreateProcessW
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
FormatMessageA
Sleep
CopyFileW
SizeofResource
LoadResource
TerminateProcess
MultiByteToWideChar
GetLastError
GetProcAddress
FindClose
GetLocalTime
LockResource
CloseHandle
LocalFree
FindResourceW
FindResourceExW
FindFirstFileW
SetConsoleMode
GetExitCodeProcess
InterlockedExchange
ReadConsoleInputA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
lstrlenA
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
InitializeCriticalSection
GetCommandLineA
HeapSetInformation
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID

advapi32

SetEntriesInAclW
SetSecurityInfo
RevertToSelf
BuildExplicitAccessWithNameW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
VariantClear
SysAllocStringByteLen

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2bdeaf2e6339b479c121acc3c45e3ff

Code Sign

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

d0:0a:b6:d7:e4:c4:6c:0a:52:61:ee:95:04:ef:b0:60:d3:4e:91:b8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 10KB - Virtual size: 10KB

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

d0:0a:b6:d7:e4:c4:6c:0a:52:61:ee:95:04:ef:b0:60:d3:4e:91:b8
Signer

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 10KB - Virtual size: 10KB