2024-05-31_8df9d3df56ffefad9c5d33c7a8e16fe8_mafia

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-31_8df9d3df56ffefad9c5d33c7a8e16fe8_mafia
Size

185KB
MD5

8df9d3df56ffefad9c5d33c7a8e16fe8
SHA1

06dc4a1d71c6c523eb2f03584222fa9d25299c66
SHA256

0a284c700f3a61d2500b788a5ca28e40e0c882cd5bab43966dc1e883df384bd1
SHA512

9cb5fc8319bb83613515d049477dc5405dab4975840cc378087fe081db580510422b78363d2016632785a5426b048c37c5a21881e2a463a3eb3418050234f0eb
SSDEEP

3072:sm2ElJDV8yQPktzYnn7IHq43ul0BIW2299EhE/78CbTftVno:sm2CXS8tzYn8HkZ24hE/Dbbo

Score

1^/10

Malware Config

Signatures

Files

2024-05-31_8df9d3df56ffefad9c5d33c7a8e16fe8_mafia
.exe windows:5 windows x86 arch:x86

501a98af5d903775a95428c42891da25

Code Sign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/12/2017, 00:00

Not After

10/12/2020, 23:59

Subject

CN=ZOHO Corporation private Limited,OU=ZOHO / ManageEngine,O=ZOHO Corporation private Limited,POSTALCODE=603202,STREET=Estancia IT Park \, Plot No. 140 & 151\, GST Road\, Vallancherry Village\, Kanchipuram\, District\,,L=Chennai,ST=Tamilnadu,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:1f:b0:c3:59:3e:c0:5f:64:8f:5d:c3:7c:0f:21:db:fe:27:d3:12
Signer

Actual PE Digest

0f:1f:b0:c3:59:3e:c0:5f:64:8f:5d:c3:7c:0f:21:db:fe:27:d3:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\File_Transfer\10-May-18\desktopcentral\1594119\SA_SRC\native\agent\Release\dcremagentinstaller.pdb

Imports

mpr

WNetCancelConnection2W
WNetAddConnection2W

kernel32

FindResourceExW
FindResourceW
LoadResource
CreateProcessW
InterlockedDecrement
GetCurrentProcess
WaitForSingleObject
GetModuleHandleW
FormatMessageA
Sleep
CopyFileW
FindFirstFileW
GetExitCodeProcess
TerminateProcess
MultiByteToWideChar
GetLastError
GetProcAddress
FindClose
GetLocalTime
LockResource
CloseHandle
LocalFree
SetConsoleMode
SizeofResource
ReadConsoleInputA
SetEndOfFile
CreateFileW
CreateFileA
WriteConsoleW
SetStdHandle
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
lstrlenA
WideCharToMultiByte
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
GetCommandLineA
HeapSetInformation
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
HeapCreate
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID

advapi32

RevertToSelf

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysStringByteLen
SysStringLen
SysAllocString
SysFreeString
VariantClear
SysAllocStringByteLen

Sections

.text
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

501a98af5d903775a95428c42891da25

Code Sign

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7dCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

0f:1f:b0:c3:59:3e:c0:5f:64:8f:5d:c3:7c:0f:21:db:fe:27:d3:12Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mpr

kernel32

advapi32

ole32

oleaut32

Sections

.text Size: 130KB - Virtual size: 129KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 6KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 10KB - Virtual size: 10KB

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

16:69:30:70:84:df:0c:b3:4e:9f:4c:61:0e:87:d9:7d
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

0f:1f:b0:c3:59:3e:c0:5f:64:8f:5d:c3:7c:0f:21:db:fe:27:d3:12
Signer

.text
Size: 130KB - Virtual size: 129KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 10KB - Virtual size: 10KB