7dfdc95bdce9abd664dc4cd906edd769_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7dfdc95bdce9abd664dc4cd906edd769_magniber_JC.exe
Size

7.5MB
MD5

7dfdc95bdce9abd664dc4cd906edd769
SHA1

9eb15a31fc62594d81ad3adec5abd68e05fd1a86
SHA256

24c170dd91e0a2303703f3282cdc30155d9484ec9be306ce868896708df2fac0
SHA512

23a37ef4cfb49a86eb12eaed4fe229d9b4aa7f887c896fd61f087d12e3b10ebae2359898f60e25adf624ffc425a4860cd43f0672303b7f445bf246b94290cdee
SSDEEP

98304:gI1YuF6UBoeinAIM0I+sax9112A8kbGqmdoAcjdN9MWGaqzFK:g0FpB3IM0/gDk3oCdN9OzFK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dfdc95bdce9abd664dc4cd906edd769_magniber_JC.exe

Files

7dfdc95bdce9abd664dc4cd906edd769_magniber_JC.exe
.exe windows x86

988e95361d132d6d79aafdd5ceaa2079

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsA
GetWindowsDirectoryA
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemDirectoryA
ConvertFiberToThread
ConvertThreadToFiberEx
GetACP
InitializeCriticalSectionAndSpinCount
SetCurrentDirectoryW
GetSystemDefaultLangID
MulDiv
DuplicateHandle
GetCurrentProcess
MapViewOfFileEx
GetFileSizeEx
OpenFileMappingA
CreateFileMappingA
GetLastError
UnmapViewOfFile
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
VirtualFreeEx
GetModuleFileNameW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
GetModuleHandleA
SwitchToThread
Sleep
GetCurrentThreadId
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalAlloc
GetProcessTimes
GetSystemTimeAsFileTime
CreateSemaphoreA
OpenProcess
GetModuleHandleW
GetTickCount
ReleaseSemaphore
WaitForMultipleObjectsEx
SetEvent
CreateEventA
FormatMessageA
FormatMessageW
LocalFree
CloseHandle
WaitForSingleObjectEx
GlobalSize
GlobalLock
GlobalUnlock
GetConsoleMode
GetStdHandle
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
WriteConsoleA
WriteFile
GetTimeZoneInformation
GetCurrentProcessId
GetSystemInfo
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
FindNextFileW
FindFirstFileExW
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleOutputCP
ReadConsoleW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
LoadLibraryExW
RtlUnwind
VirtualFree
InterlockedPushEntrySList
OutputDebugStringA
WideCharToMultiByte
LoadLibraryW
GetProcAddress
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
GetWindowsDirectoryW
MoveFileExW
AreFileApisANSI
MultiByteToWideChar
IsValidCodePage
IsDBCSLeadByteEx
HeapAlloc
HeapFree
GetProcessHeap
ResetEvent
OpenEventA
SetWaitableTimer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
SetLastError
WriteConsoleW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
GetSystemDirectoryW
FreeLibrary
CompareFileTime
SleepEx
VerSetConditionMask
VerifyVersionInfoW
GetSystemTime
SystemTimeToFileTime
GetExitCodeThread
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSRWLock
TryAcquireSRWLockExclusive
GetStringTypeW
GetLocaleInfoEx
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
CompareStringEx
GetCPInfo
ExitProcess
lstrlenA
SetFilePointer
LoadResource
LockResource
SizeofResource
FindResourceW
DosDateTimeToFileTime
lstrcpyA
lstrcpyW
GetFileSize
CreateFileMappingW
HeapDestroy
HeapReAlloc
HeapSize
CreateEventW
lstrlenW
ReleaseSRWLockShared
AcquireSRWLockShared
HeapCreate
InitializeCriticalSection
FlushInstructionCache
FindClose
FindFirstFileW
FreeResource
GetVersionExW
GetLocalTime
GetVersionExA
LoadLibraryA
RaiseException
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW

user32

FlashWindowEx
GetWindowTextW
GetClassNameW
GetWindowThreadProcessId
EnumChildWindows
GetDesktopWindow
PostMessageW
GetDC
ReleaseDC
OffsetRect
DrawTextW
FillRect
InvertRect
InflateRect
DrawIconEx
GetIconInfo
OemToCharBuffW
CreateIconFromResource
CreateIconIndirect
TranslateMessage
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
UnregisterClassW
DefWindowProcW
CallWindowProcW
RegisterClassExW
CreateWindowExW
SetWindowPos
GetDlgItem
GetActiveWindow
GetClientRect
GetWindowRect
MapWindowPoints
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadCursorW
MonitorFromWindow
GetMonitorInfoW
TrackMouseEvent
PostQuitMessage
DestroyWindow
AnimateWindow
SetLayeredWindowAttributes
IsIconic
SetFocus
GetCapture
SetCapture
ReleaseCapture
SetTimer
KillTimer
UpdateWindow
BeginPaint
IsClipboardFormatAvailable
InvalidateRect
CreateCaret
GetCaretBlinkTime
HideCaret
SetCaretPos
ScreenToClient
CopyRect
EmptyClipboard
DestroyIcon
SetCursor
SetRect
EqualRect
DestroyCursor
IsMenu
IsWindowEnabled
CreatePopupMenu
DestroyMenu
GetMenuItemCount
AppendMenuW
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetForegroundWindow
SetMenuContextHelpId
GetSysColor
MessageBoxW
LoadIconW
CharNextW
GetFocus
EnableMenuItem
ClientToScreen
LoadBitmapW
LoadImageW
GetWindowDC
SetPropW
GetPropW
RemovePropW
GetClassLongW
SetClassLongW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetMessageW
IsWindowVisible
SystemParametersInfoA
EnableWindow
SetActiveWindow
CharLowerBuffW
MapVirtualKeyA
UpdateLayeredWindow
GetForegroundWindow
IntersectRect
IsRectEmpty
PtInRect
GetProcessWindowStation
GetUserObjectInformationW
SetClipboardData
IsWindow
OpenClipboard
GetClipboardData
CloseClipboard
GetClipboardSequenceNumber
IsZoomed
SetWindowTextW
SendMessageA
ShowWindow
GetCursorPos
UnionRect
GetKeyState
GetSystemMetrics
SendMessageW
EndPaint

gdi32

IntersectClipRect
OffsetRgn
Pie
PtInRegion
RectInRegion
GetStockObject
RestoreDC
GetTextExtentPoint32W
SaveDC
ExtSelectClipRgn
SelectObject
SetBkMode
SetGraphicsMode
GetRgnBox
GetClipRgn
GetClipBox
RoundRect
DeleteObject
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgnIndirect
CreateRectRgn
CreatePatternBrush
CreatePen
CreateFontIndirectW
CreateEllipticRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
SetRectRgn
SetROP2
SetTextColor
GetWorldTransform
SetWorldTransform
CreateDIBSection
ExtCreatePen
GetObjectW
Polyline
SetViewportOrgEx
CreateDIBitmap
CreateBitmap
CreateDCW
StretchDIBits
StretchBlt
GetDeviceCaps
CombineRgn
BitBlt
ExcludeClipRect
EnumFontsW
Arc
Ellipse
GetTextColor
GetViewportOrgEx
Rectangle
GetCurrentObject

advapi32

CryptReleaseContext
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
SystemFunction036
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptSignHashW
CryptEnumProvidersW
CryptGetHashParam

shell32

ShellExecuteA
ShellExecuteW

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoUninitialize
IIDFromString
OleLockRunning
CLSIDFromString
CoInitialize
CreateBindCtx
CLSIDFromProgID
OleInitialize
OleUninitialize

oleaut32

SysFreeString
SysAllocString

shlwapi

StrChrW
StrToIntExW

psapi

EnumProcesses
GetModuleFileNameExW

ws2_32

getsockname
accept
sendto
recvfrom
bind
WSAGetLastError
select
__WSAFDIsSet
WSASetLastError
ntohs
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
listen
WSACloseEvent
send
getsockopt
inet_ntop
socket
htons
closesocket
inet_pton
ntohl
recv
connect
getpeername
gethostname
ioctlsocket
setsockopt
shutdown
WSAIoctl
htonl
WSAStartup
WSACreateEvent
InetNtopW
gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
getservbyport
getservbyname
freeaddrinfo
getaddrinfo
WSAStringToAddressW
WSACleanup

crypt32

CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CryptQueryObject
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertDuplicateCertificateContext

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

gdiplus

GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGraphicsClear
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetPropertyItem
GdipDrawImageRectI
GdipGetPropertyItemSize
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipImageSelectActiveFrame
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameCount
GdipSaveImageToFile

msimg32

GradientFill
AlphaBlend

winmm

timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeGetTime

imm32

ImmReleaseContext
ImmAssociateContext
ImmGetContext

iphlpapi

GetBestRoute2
GetUnicastIpAddressTable
FreeMibTable
GetAdaptersAddresses

Exports

Exports

?$TSS0@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@34@XZ@4HA
??4?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@QAEAAV012@ABV012@@Z
?create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@23@XZ
?getInstance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SAAAUPolymorphicCasters@23@XZ
?instance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@0AAUPolymorphicCasters@23@A
?t@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAAUPolymorphicCasters@34@XZ@4U534@A

Sections

.text
Size: 4.3MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.7z0
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

988e95361d132d6d79aafdd5ceaa2079

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

ws2_32

crypt32

bcrypt

gdiplus

msimg32

winmm

imm32

iphlpapi

Exports

Exports

Sections

.text Size: 4.3MB - Virtual size: 4.3MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 94KB - Virtual size: 177KB

.7z0 Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 252KB - Virtual size: 252KB

.rsrc Size: 127KB - Virtual size: 127KB

.text
Size: 4.3MB - Virtual size: 4.3MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 94KB - Virtual size: 177KB

.7z0
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 252KB - Virtual size: 252KB

.rsrc
Size: 127KB - Virtual size: 127KB