2023-08-26_2e1e4b3ac13d42b8dac93472ddd5e4f4_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_2e1e4b3ac13d42b8dac93472ddd5e4f4_magniber_JC.exe
Size

2.2MB
MD5

2e1e4b3ac13d42b8dac93472ddd5e4f4
SHA1

0fb9b0df07101337ccec73c210c273e566d7988a
SHA256

e22149a000767e9a6f8b230673e506374ee167002e4e364166546e0bfa19e304
SHA512

3e7c11896e75c2925a53af50f785e358c8e281d0e3d187bf54b71d7114161970d5afb616791f9dd91830ddcb53673a5b0434d40eb40339631ac1d67b406f2929
SSDEEP

49152:mgWlbH8mH1b/+vKDyts3QIRcAzbi8LnI16:mgWlbcmVb/+vKD2eSAzP

Score

1^/10

Malware Config

Signatures

Files

2023-08-26_2e1e4b3ac13d42b8dac93472ddd5e4f4_magniber_JC.exe
.exe windows x86

fa6ae3e2aca2275c852cbfbfb12c412c

Code Sign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

06/08/2019, 04:31

Not After

29/05/2021, 09:07

Subject

SERIALNUMBER=91110107055619070H,CN=J.onaxh Network Technology Co.\, Ltd.,O=J.onaxh Network Technology Co.\, Ltd.,STREET=石景山区八大处高科技园区西井路3号3号楼2095A房间,L=北京,ST=北京,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

18/11/2009, 10:00

Not After

18/03/2019, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:29:15:27:00:00:00:00:00:2a
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:55

Not After

15/04/2021, 20:05

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

06/08/2019, 04:31

Not After

29/05/2021, 09:07

Subject

SERIALNUMBER=91110107055619070H,CN=J.onaxh Network Technology Co.\, Ltd.,O=J.onaxh Network Technology Co.\, Ltd.,STREET=石景山区八大处高科技园区西井路3号3号楼2095A房间,L=北京,ST=北京,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074245494a494e47,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2018, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

49:c7:cc:fb:54:10:f1:53:48:7c:5e:20:d0:36:70:0a:88:8c:fc:83:fa:25:c2:de:30:92:7b:56:a5:96:f6:38
Signer

Actual PE Digest

49:c7:cc:fb:54:10:f1:53:48:7c:5e:20:d0:36:70:0a:88:8c:fc:83:fa:25:c2:de:30:92:7b:56:a5:96:f6:38

Digest Algorithm

sha256

PE Digest Matches

false

55:f3:28:61:fd:19:ce:6f:b8:cf:0c:72:0b:30:11:57:0f:b8:b6:26
Signer

Actual PE Digest

55:f3:28:61:fd:19:ce:6f:b8:cf:0c:72:0b:30:11:57:0f:b8:b6:26

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
GlobalUnlock
GetTempPathW
LocalFree
WaitForSingleObject
HeapReAlloc
HeapSize
WritePrivateProfileStringW
GetPrivateProfileStringW
FreeResource
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetProcessImageFileNameW
GetPriorityClass
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
LoadResource
InitializeCriticalSection
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
lstrcmpW
lstrcpyW
FindNextFileW
FindFirstFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
DecodePointer
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
GlobalAlloc
VirtualAlloc
GetThreadTimes
UnregisterWait
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
SetStdHandle
GetConsoleMode
GetConsoleCP
GetACP
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
GetProcessHeap
GetTickCount
GetCommandLineW
CreateEventW
RaiseException
CreateProcessW
CreateMutexW
Sleep
MulDiv
HeapFree
HeapAlloc
MoveFileW
DeleteFileW
VirtualProtect
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CloseHandle
FindFirstFileExW
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
RegisterWaitForSingleObject
GetProcAddress
WaitForSingleObjectEx
UnregisterWaitEx
SetThreadPriority
FindClose
GetUserDefaultLangID
SetFilePointerEx
FlushFileBuffers
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
ReleaseMutex
OutputDebugStringA
SystemTimeToFileTime
IsBadWritePtr
IsBadReadPtr
CreateWaitableTimerW
WaitForMultipleObjects
CancelWaitableTimer
SetWaitableTimer
SetFileTime
SetFilePointer
SetEndOfFile
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
SuspendThread
TerminateThread
CreateThread
CopyFileW
WriteFile
RemoveDirectoryW
ReadFile
GetTempFileNameW
GetFileAttributesExW
CreateDirectoryW
lstrcmpA
DeviceIoControl
CreateFileW
LoadLibraryW
GetModuleHandleA
GetVersionExW
OutputDebugStringW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetStringTypeW
MultiByteToWideChar
GetModuleHandleExW
QueueUserWorkItem
GetNativeSystemInfo
GetCurrentThread
SwitchToThread
DuplicateHandle
EncodePointer
TryEnterCriticalSection
WideCharToMultiByte
FormatMessageW
InitializeSListHead
GetStartupInfoW

user32

DeferWindowPos
EndDeferWindowPos
SetClipboardData
GetFocus
IsClipboardFormatAvailable
GetClipboardData
SendMessageTimeoutW
GetSystemMetrics
GetAncestor
SendInput
MapVirtualKeyW
GetLastActivePopup
GetTopWindow
GetWindow
GetDesktopWindow
EndDialog
GetMessageW
DispatchMessageW
TranslateMessage
SetWindowLongW
GetWindowLongW
CreateWindowExW
SendMessageW
PostMessageW
GetWindowTextW
SetWindowPos
GetWindowRect
ScreenToClient
BeginPaint
CloseClipboard
GetDC
PostQuitMessage
ReleaseDC
UpdateWindow
ShowWindow
IsWindowVisible
SetTimer
KillTimer
GetParent
GetDlgItem
MessageBoxW
OpenClipboard
GetWindowThreadProcessId
IsWindow
GetClassNameW
GetMonitorInfoW
DefWindowProcW
LoadCursorW
RegisterClassExW
EnumDisplayMonitors
BeginDeferWindowPos
DialogBoxParamW
GetCursorPos
SetCursor
GetRawInputData
mouse_event
UpdateLayeredWindow
FindWindowW
LoadIconW
RegisterClassW
GetForegroundWindow
SetLayeredWindowAttributes
GetLastInputInfo
EmptyClipboard
SetForegroundWindow
GetWindowDC
RegisterRawInputDevices
GetShellWindow
EndPaint
MonitorFromWindow
EnumWindows
SystemParametersInfoW

gdi32

CreateSolidBrush
GetObjectW
GetStockObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
SelectObject
CreateFontIndirectW
GetDeviceCaps

advapi32

RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW

shell32

SHCreateDirectoryExW
SHGetFolderPathW
SHFileOperationW
ShellExecuteExW
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize

shlwapi

PathGetDriveNumberW
PathFileExistsW
SHGetValueW
PathAppendW
SHSetValueW
SHDeleteValueW
StrStrIW
SHGetValueA
SHSetValueA

gdiplus

GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipResetPath
GdipAddPathString
GdipCreateFromHDC
GdipDeleteGraphics
GdipReleaseDC
GdipSetTextRenderingHint
GdipFree
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipDrawRectangleI
GdipGraphicsClear
GdipDrawString
GdipDrawImagePointRectI
GdipGetPathWorldBounds
GdipGetFontCollectionFamilyCount
GdipGetFontCollectionFamilyList
GdipCloneFontFamily
GdipNewPrivateFontCollection
GdipDeletePrivateFontCollection
GdipPrivateAddFontFile
GdipPrivateAddMemoryFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GdipSetInterpolationMode
GdipCreateBitmapFromStream
GdipCloneImage

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wtsapi32

WTSRegisterSessionNotification

powrprof

PowerReadACValueIndex
PowerReadDCValueIndex
PowerGetActiveScheme

netapi32

Netbios

wininet

InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetQueryOptionW
InternetSetOptionW
HttpOpenRequestW
HttpAddRequestHeadersA
InternetOpenUrlW
HttpSendRequestW
HttpQueryInfoA
HttpQueryInfoW
InternetErrorDlg
InternetReadFileExA
InternetWriteFile
InternetSetOptionA
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
FtpOpenFileW
FtpCommandW
FtpGetFileSize
HttpSendRequestExW
HttpEndRequestW
HttpAddRequestHeadersW

winmm

timeGetTime

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 30KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

fa6ae3e2aca2275c852cbfbfb12c412c

Code Sign

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:25:07:1d:f9:afCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

61:29:15:27:00:00:00:00:00:2aCertificate

Key Usages

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4Certificate

Extended Key Usages

Key Usages

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

49:c7:cc:fb:54:10:f1:53:48:7c:5e:20:d0:36:70:0a:88:8c:fc:83:fa:25:c2:de:30:92:7b:56:a5:96:f6:38Signer

55:f3:28:61:fd:19:ce:6f:b8:cf:0c:72:0b:30:11:57:0f:b8:b6:26Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

gdiplus

version

wtsapi32

powrprof

netapi32

wininet

winmm

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 161KB - Virtual size: 161KB

.data Size: 30KB - Virtual size: 63KB

.rsrc Size: 81KB - Virtual size: 81KB

.reloc Size: 68KB - Virtual size: 72KB

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:00:00:00:00:01:25:07:1d:f9:af
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

61:29:15:27:00:00:00:00:00:2a
Certificate

63:fa:7f:20:7c:ac:18:d1:50:aa:1f:a4
Certificate

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

49:c7:cc:fb:54:10:f1:53:48:7c:5e:20:d0:36:70:0a:88:8c:fc:83:fa:25:c2:de:30:92:7b:56:a5:96:f6:38
Signer

55:f3:28:61:fd:19:ce:6f:b8:cf:0c:72:0b:30:11:57:0f:b8:b6:26
Signer

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 161KB - Virtual size: 161KB

.data
Size: 30KB - Virtual size: 63KB

.rsrc
Size: 81KB - Virtual size: 81KB

.reloc
Size: 68KB - Virtual size: 72KB