CalmMofaba (possible malware) not in here?
Lampe2020 opened this issue · comments
I once found a program called CalmMofaba.exe on one of my school's computers. The admin didn't recognize it and he deleted it, luckily I had already made a copy of it.
The icon leaves me to believe it's one of those search bars, although it did nothing when I tried to run it on a spare laptop with the same version of Win10 on it that I found the file on.
Interestingly enough the exe seems like it wants to behave like an archive itself, with several @UVWATAUAVAWH sequences in the HEX editor, like headers for something.
In case you want to add it to your repo, here's a link to it hosted on my website, as GitHub takes longer than ten minutes to start uploading it: Directory listing on my website
You have probably a bit more experience with recognizing malware than me, so you have to decide if it's worthy to be in your repo, I'll accept it if you simply say you're not interested in this file.
create a vm,disable the antivitus and run it as administrator...it will be able tu run
i will try to test it as trustedinstaller o my pc with malwarebytes,it may be safe
This seems like a part of a malware install, ince this is a service executable. I couldn't get it to start even using sc command, it just freezes. Maybe it requires some other files to run. My personal guess is that it's a possible cryptominer, since that what you can usually find on school computers (at least at my school lmao), and I had experience with miners that had bizzare names and icons.
Update: Done a VT scan, it says that's an adware updater. Well, that's pretty common as well...
as i found , it's 16 bits so i'll try it on a vm with a 16 bits os and other files from noescape to find the virus and extract it to send it here
i'll open it and check what it is
Didn't think I'll come back to this, but I'll clear up any confusion left
as i found , it's 16 bits so i'll try it on a vm with a 16 bits os and other files from noescape to find the virus and extract it to send it here
The file is 64 bit, compiled for NT 6.0 (so Windows Vista or longhorn), written in native C/C++ and compiled with Visual Studio 2013
The file was signed, however the certificate was revoked. It is a service executable, so not a regular process.
All this info can be gathered using standart windows utilities.
Not sure why You thought it was 16 bit, since it was originally running on a school PC, which was probably not having ms-dos as an operating system.
If my "research" was not enough, here's the screenshot of it opened in a hex editor.
If my "research" was not enough, here's the screenshot of it opened in a hex editor.
Could you please explain the screenshot? I only recognize the This program cannot be run in DOS mode. part, the other bytes in the screenshot are mystery magic to me. I also have opened the file in a HEX editor, but I don't know the PE format very well.
Sorry, I cropped the image a tiny bit more than needed. It should look like this:
I coloured it a bit, to make explaining easier.
The part that I highlighted with red is a dos header, standart for all pe files. The green part is the offset to pe header, so it can be executed under Windows. The blue part is the dos stub (code that get's executed on dos. In this case it shows the message that the program cannot be ran on dos, meaning it's probably not 16 bit). The yellow part is the PE signature, and the purple part shows the actual architecture the code was compiled for (so 0x6486, which according to microsoft website is x64). The program was compiled for a 64 bit cpu.
Here's a screenshot of a dos executable for comparison:
We see the dos header, and after it the code. No PE signatures or offset.
Hope I could explain it and it's understandable...
Note, I only placed the screenshot for proof that the file is a Windows 64 bit executable, not to show what the executable does.
the purple part shows the actual architecture the code was compiled for (so 0x6486, which according to microsoft website is x64). The program was compiled for a 64 bit cpu.
Interesting. So they just used the hex numbers as a label, instead of ASCII characters or the numbers converted to hex XD
Thanks for the explanation by the way, I think I do now understand the fundamentals of it.
i can't download it (edge says "virus detected" but with a trojan , it didn't stopped the download)