1c280775db81bd7aaf599f6f8c1c40a4_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1c280775db81bd7aaf599f6f8c1c40a4_magniber_JC.exe
Size

823KB
MD5

1c280775db81bd7aaf599f6f8c1c40a4
SHA1

9c3262532b03fe21446b09ddc704cc58b20c7bc6
SHA256

b7a3142421247f1fe215db5b243e234d01a884fc5e23fe14e8ca5c6e209e4d57
SHA512

6ebaa7faf54048c24f0f42d520014c5b0c77442000dc1506039fe6ee35f99896bb94714e5f8509e51da7bead80de591e17a2b6d171110c284d11107d0ca13653
SSDEEP

24576:TVL5eqQdEC22GSkOuf6Bm42GhrEl1HLPvSW5kO81ddI9vKTSbU8fiG/US:TVL3+Rmkt2SToU8fiG/US

Score

1^/10

Malware Config

Signatures

Files

1c280775db81bd7aaf599f6f8c1c40a4_magniber_JC.exe
.exe windows x86

804bc2fe96148ca971fe80a91f34ada3

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:35:c2:35:da:19:8a:59:7d:5f:a1:9e:c5:e2:61:9d:88:74:61:c1
Signer

Actual PE Digest

20:35:c2:35:da:19:8a:59:7d:5f:a1:9e:c5:e2:61:9d:88:74:61:c1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
WideCharToMultiByte
OpenProcess
SetFileAttributesW
ReadFile
GetFileSize
WriteFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcmpW
GetVersion
lstrcpyW
GetFileAttributesW
GetTickCount
LocalFree
FormatMessageW
lstrcatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetSystemDirectoryW
GetLogicalDriveStringsW
SetEvent
WaitForSingleObject
CreateThread
GetPrivateProfileStringA
GetPrivateProfileIntW
GetTempPathW
GetCommandLineW
CreateEventW
FindClose
FindNextFileW
FindFirstFileW
GetUserDefaultLangID
GetTempFileNameW
CreateFileA
SetFilePointer
DeleteFileA
MoveFileA
Sleep
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
ExitProcess
GetConsoleCP
GetLocaleInfoA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
GetStartupInfoA
SetHandleCount
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetTimeZoneInformation
GetModuleHandleA
FatalAppExitA
HeapCreate
GetCurrentThread
GetModuleFileNameA
GetStdHandle
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetFileType
SystemTimeToFileTime
LocalFileTimeToFileTime
SetEndOfFile
GetFileSizeEx
SetFilePointerEx
GetEnvironmentVariableW
SetEnvironmentVariableW
TlsFree
TlsAlloc
OpenThread
TlsSetValue
TlsGetValue
ReleaseMutex
GetSystemTimeAsFileTime
OutputDebugStringW
LoadLibraryW
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
ExpandEnvironmentStringsW
FreeResource
IsBadReadPtr
VirtualProtect
CreateMutexW
lstrcpynW
lstrlenA
lstrcpynA
GetVersionExW
GetSystemTime
CopyFileW
DeleteFileW
CreateDirectoryW
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
SetLastError
lstrcmpiW
RaiseException
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
GetCurrentThreadId
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
GetCurrentProcess
FlushInstructionCache
MultiByteToWideChar
GetProcAddress
FreeLibrary
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode

user32

CopyRect
GetParent
GetWindowInfo
GetActiveWindow
UnregisterClassA
FindWindowW
DestroyWindow
wvsprintfW
SetWindowLongW
GetForegroundWindow
GetDoubleClickTime
GetSubMenu
EndDialog
MonitorFromWindow
DialogBoxParamW
LoadIconW
SetForegroundWindow
ClientToScreen
DrawTextW
TrackMouseEvent
EndPaint
BeginPaint
GetMenuState
GetMenuItemID
GetMenuStringW
CallNextHookEx
IsDialogMessageW
UnhookWindowsHookEx
LoadMenuW
IsWindowVisible
UpdateWindow
EnableWindow
GetDlgItem
SetWindowPos
IsWindow
GetWindowLongW
CheckDlgButton
LoadCursorW
SetRectEmpty
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CharNextW
CallWindowProcW
GetWindowRect
GetClientRect
ScreenToClient
GetDC
ReleaseDC
ShowWindow
SetTimer
KillTimer
PtInRect
SetCursor
GetCursorPos
UpdateLayeredWindow
SetCapture
RegisterClassExW
LoadImageW
CreateWindowExW
ReleaseCapture
PostMessageW
SendMessageTimeoutW
RegisterWindowMessageW
TranslateAcceleratorW
InvalidateRect
SendMessageW
CreatePopupMenu
AppendMenuW
RemoveMenu
MapWindowPoints
SetMenuItemInfoW
GetMenuItemInfoW
SetMenuDefaultItem
LoadStringW
SetDlgItemTextW
SetWindowTextW
SetFocus
PostQuitMessage
LoadStringA
GetMenuItemCount
DestroyMenu
GetMonitorInfoW
MonitorFromPoint
TrackPopupMenuEx
MessageBeep
DestroyIcon
GetDesktopWindow
SystemParametersInfoW
MessageBoxW
IntersectRect
MoveWindow
GetSystemMetrics
GetWindowThreadProcessId
GetAncestor
WindowFromPoint
GetShellWindow
FindWindowExW
GetClassNameW
GetWindow
EnumWindows
DeleteMenu
SetWindowsHookExW
GetDlgItemTextW
CreateDialogParamW
GetClassInfoExW
EnableMenuItem

gdi32

GetViewportOrgEx
CreateCompatibleBitmap
SetDIBits
CreateDIBSection
BitBlt
CreateFontW
GetObjectA
SetStretchBltMode
SetViewportOrgEx
GetDeviceCaps
CreateDCW
GetObjectW
GetStockObject
SelectPalette
RealizePalette
DeleteObject
DeleteDC
SelectObject
PatBlt
CreateCompatibleDC
MoveToEx
LineTo
CreatePen
GdiFlush
StretchBlt
GetDIBits

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegQueryValueExA
RegDeleteValueW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW

shell32

SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW
SHGetFolderPathW
SHCreateDirectoryExA

ole32

CoTaskMemAlloc
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysFreeString

shlwapi

SHDeleteValueA
PathFindExtensionW
StrCmpIW
PathRemoveFileSpecW
PathAppendW
PathFindFileNameW
StrStrIW
SHGetValueW
SHSetValueW
PathFileExistsW
SHSetValueA
StrStrIA
SHDeleteValueW
PathRemoveFileSpecA
PathAddBackslashW
PathCombineW

comctl32

_TrackMouseEvent
InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCloneBrush
GdiplusShutdown
GdiplusStartup
GdipCreateFontFromDC
GdipDrawString
GdipDrawLine
GdipSetStringFormatTrimming
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCreateSolidFill
GdipCreateHBITMAPFromBitmap
GdipDeleteFont
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipCloneImage
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImageRawFormat
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateFontFromLogfontA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

GetModuleFileNameExW

winmm

timeKillEvent
timeEndPeriod
timeBeginPeriod
timeSetEvent

urlmon

URLDownloadToFileW

ws2_32

htons
gethostbyname
socket
WSAEventSelect
connect
WSAGetLastError
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
send
recv
shutdown
closesocket
WSACloseEvent
WSAStartup
WSACleanup
getsockname
WSACreateEvent
WSAAsyncSelect
WSAAsyncGetHostByName
bind
ioctlsocket
setsockopt
gethostname

wininet

InternetCrackUrlW
InternetQueryOptionA
InternetQueryOptionW

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
FreeCredentialsHandle

Sections

.text
Size: 491KB - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

804bc2fe96148ca971fe80a91f34ada3

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

20:35:c2:35:da:19:8a:59:7d:5f:a1:9e:c5:e2:61:9d:88:74:61:c1Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

psapi

winmm

urlmon

ws2_32

wininet

secur32

Sections

.text Size: 491KB - Virtual size: 491KB

.rdata Size: 85KB - Virtual size: 84KB

.data Size: 16KB - Virtual size: 29KB

.rsrc Size: 223KB - Virtual size: 222KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

20:35:c2:35:da:19:8a:59:7d:5f:a1:9e:c5:e2:61:9d:88:74:61:c1
Signer

.text
Size: 491KB - Virtual size: 491KB

.rdata
Size: 85KB - Virtual size: 84KB

.data
Size: 16KB - Virtual size: 29KB

.rsrc
Size: 223KB - Virtual size: 222KB