32570bfc6013c8767140a56d96d3fa57_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

32570bfc6013c8767140a56d96d3fa57_magniber_JC.exe
Size

5.2MB
MD5

32570bfc6013c8767140a56d96d3fa57
SHA1

97e3ec450a7b521f1d13a8ca34e7bf6b4e4b9e38
SHA256

b79e7b0fab21ec37cda3df4a7246ad959dd4a1480976d520ad544a4df5d63538
SHA512

fad28db3330a2fb8a1d7e0830dee82b122c285fbbfe09de130a3f072c1307e04c690785faf4f476c311ceaa9507d4578b7f539ab825e442115076fb06a02827e
SSDEEP

98304:20IXubWs3ohqCnEPocqByO7X6B1ri21bz7sCdGc0:IXdsCEPohByO7q3F1O

Score

1^/10

Malware Config

Signatures

Files

32570bfc6013c8767140a56d96d3fa57_magniber_JC.exe
.exe windows x86

09d2437da2b72deeac186b54dac00d60

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:8c:d5:c6:0b:9a:92:1d:64:59:b8:35:eb:24:ff:cf
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

13/01/2023, 00:00

Not After

13/01/2024, 23:59

Subject

CN=YARD STAR\, TOO,O=YARD STAR\, TOO,ST=Karagandinskaya oblast',C=KZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

46:54:b6:3c:5b:99:08:a4:68:df:d4:c0:58:5b:fc:d9:77:09:bc:c6
Signer

Actual PE Digest

46:54:b6:3c:5b:99:08:a4:68:df:d4:c0:58:5b:fc:d9:77:09:bc:c6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileAttributesW
GetTempPathW
AreFileApisANSI
CloseHandle
SetLastError
GetModuleHandleW
MoveFileExW
WideCharToMultiByte
FormatMessageW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
DeleteFileW
GetModuleFileNameW
CreateProcessW
GetVersionExW
GetTempFileNameW
GetWindowsDirectoryW
GetDriveTypeW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileW
lstrlenW
WriteFile
VirtualFree
VirtualAlloc
CreateFileW
VerSetConditionMask
VerifyVersionInfoW
FlushFileBuffers
VirtualQuery
ReadFile
SetFilePointer
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetSystemInfo
GetFileType
WriteConsoleW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
CreateDirectoryW
GetCurrentDirectoryW
SleepEx
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
FormatMessageA
CreateFileA
PeekNamedPipe
SetEndOfFile
LocalFree
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GetCommandLineW
SizeofResource
FreeLibrary
GetProcessHeap
OpenProcess
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
HeapFree

user32

DispatchMessageW
ShowWindow
TranslateMessage
wsprintfW
GetDesktopWindow
GetMessageW
GetWindowRect

shell32

SHGetKnownFolderPath
SHGetFolderPathW

ole32

CoCreateInstance
OleInitialize
CoTaskMemFree
OleUninitialize
CoSetProxyBlanket
CoInitializeEx

winhttp

WinHttpConnect
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetStatusCallback
WinHttpReadData
WinHttpOpen
WinHttpSetTimeouts

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

userenv

UnloadUserProfile

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

ioctlsocket
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
getpeername
WSACleanup
WSAIoctl
WSASetLastError
inet_ntoa
WSAStartup
gethostbyname
WSAGetLastError
socket
recv
send
bind
closesocket
setsockopt
connect
getsockname
getsockopt
htons
ntohs

wininet

InternetCrackUrlW

advapi32

AddAce
InitializeAcl
GetLengthSid
OpenProcessToken
GetTokenInformation
IsValidSid
InitializeSid
SetNamedSecurityInfoW
GetSidLengthRequired
GetSidSubAuthority
CryptGenRandom
CryptAcquireContextA
RegGetValueW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CopySid
CryptAcquireContextW
ConvertSidToStringSidW

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

dbghelp

SymFunctionTableAccess64
StackWalk64
SymCleanup
SymGetOptions
SymGetModuleBase64
SymInitialize
SymSetOptions

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetCertificateChain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09d2437da2b72deeac186b54dac00d60

Code Sign

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

a8:8c:d5:c6:0b:9a:92:1d:64:59:b8:35:eb:24:ff:cfCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

46:54:b6:3c:5b:99:08:a4:68:df:d4:c0:58:5b:fc:d9:77:09:bc:c6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

winhttp

rpcrt4

userenv

version

ws2_32

wininet

advapi32

oleaut32

dbghelp

crypt32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 20KB - Virtual size: 30KB

.rsrc Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 47KB - Virtual size: 46KB

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

a8:8c:d5:c6:0b:9a:92:1d:64:59:b8:35:eb:24:ff:cf
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

46:54:b6:3c:5b:99:08:a4:68:df:d4:c0:58:5b:fc:d9:77:09:bc:c6
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 20KB - Virtual size: 30KB

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 47KB - Virtual size: 46KB