2024-05-31_88d572b1f9e7bf4bf3c2287b7b3382e2_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-31_88d572b1f9e7bf4bf3c2287b7b3382e2_mafia
Size

188KB
MD5

88d572b1f9e7bf4bf3c2287b7b3382e2
SHA1

7e9db0122257511d884c9bbfebe35cc695889e73
SHA256

86f16ba6aa79550362560199c84b47befc8ad6b423cdc30a6dcc5b63353ca686
SHA512

5017fd06b90080fb55f3795df609f59492efbd95cb126bc13cbe299b49f3de99a1a861270c131348234863088549c903592bbffad807ceeff70ae2a1c9746fe5
SSDEEP

3072:or28rppeOpGyVPon5HqFVGHt33WUx4c5EnMbTNVZKT9wRJZG:or2Qpp/vVPonwSwE4c5En+NVkGQ

Score

1^/10

Malware Config

Signatures

Files

2024-05-31_88d572b1f9e7bf4bf3c2287b7b3382e2_mafia
.exe windows:5 windows x86 arch:x86

d2bdeaf2e6339b479c121acc3c45e3ff

Code Sign

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/12/2017, 00:00

Not After

10/12/2020, 23:59

Subject

CN=ZOHO Corporation private Limited,OU=ZOHO / ManageEngine,O=ZOHO Corporation private Limited,POSTALCODE=603202,STREET=Estancia IT Park \, Plot No. 140 & 151\, GST Road\, Vallancherry Village\, Kanchipuram\, District\,,L=Chennai,ST=Tamilnadu,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

Issuer

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

02/05/2019, 00:00

Not After

30/05/2020, 10:48

Subject

CN=Sectigo SHA-1 Time Stamping Signer,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/04/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Time Stamping CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:45:2f:0f:78:59:d6:3e:cc:6d:bf:f6:c1:69:91:df:dd:00:97:1d
Signer

Actual PE Digest

70:45:2f:0f:78:59:d6:3e:cc:6d:bf:f6:c1:69:91:df:dd:00:97:1d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\File_Transfer\10-Jul-19\desktopcentral\2366038\ONPREMISE\SA_SRC\native\agent\Release\dcremagentinstaller.pdb

Imports

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

CreateProcessW
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
FormatMessageA
Sleep
CopyFileW
SizeofResource
LoadResource
TerminateProcess
MultiByteToWideChar
GetLastError
GetProcAddress
FindClose
GetLocalTime
LockResource
CloseHandle
LocalFree
FindResourceW
FindResourceExW
FindFirstFileW
SetConsoleMode
GetExitCodeProcess
InterlockedExchange
ReadConsoleInputA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
lstrlenA
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
InitializeCriticalSection
GetCommandLineA
HeapSetInformation
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID

advapi32

SetEntriesInAclW
SetSecurityInfo
RevertToSelf
BuildExplicitAccessWithNameW

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
VariantClear
SysAllocStringByteLen

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d2bdeaf2e6339b479c121acc3c45e3ff

Code Sign

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49Certificate

Extended Key Usages

Key Usages

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19Certificate

Extended Key Usages

Key Usages

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

70:45:2f:0f:78:59:d6:3e:cc:6d:bf:f6:c1:69:91:df:dd:00:97:1dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 130KB - Virtual size: 130KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 10KB - Virtual size: 10KB

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

2b:73:db:74:63:11:4c:5a:5b:32:4a:f2:30:57:72:49
Certificate

62:5c:4d:90:8c:d5:42:fb:ab:2e:a5:73:3f:f1:54:19
Certificate

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

70:45:2f:0f:78:59:d6:3e:cc:6d:bf:f6:c1:69:91:df:dd:00:97:1d
Signer

.text
Size: 130KB - Virtual size: 130KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 10KB - Virtual size: 10KB