2023-08-27_7ff45c803e9862d882c19df06c487e4d_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-27_7ff45c803e9862d882c19df06c487e4d_magniber_JC.exe
Size

892KB
MD5

7ff45c803e9862d882c19df06c487e4d
SHA1

cba493b5b6051c8a6efa808589151e14d9b63c45
SHA256

881e734e3b58917817781ef2f98bf2315aaf121e7e2230af2004a89e09d7993f
SHA512

977db4fa417d7213279f885f8fb16c17c6992e7fe2a610538fde3b2307f5f775998b199dcfe0d35d11a0772ea42f7958cc54e7c04c2ff008be3ebfa987c0695a
SSDEEP

24576:VKiHGlDUDIZ+93PRCeK4qBdZ11G8WGZTpbA/vN:EDgP0dT/ZTpbA/V

Score

1^/10

Malware Config

Signatures

Files

2023-08-27_7ff45c803e9862d882c19df06c487e4d_magniber_JC.exe
.exe windows:5 windows x86

8167f0f814162fc811ac0ab3687603d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16/03/2010, 00:00

Not After

15/03/2013, 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

88:8d:50:a1:67:90:eb:69:a7:21:be:4b:84:d7:ad:c4:08:ec:72:99
Signer

Actual PE Digest

88:8d:50:a1:67:90:eb:69:a7:21:be:4b:84:d7:ad:c4:08:ec:72:99

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalLock
GlobalAlloc
FindResourceExW
EnterCriticalSection
LeaveCriticalSection
GetVersion
GetCommandLineW
CloseHandle
GetLastError
CreateMutexW
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteCriticalSection
InterlockedIncrement
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetFullPathNameA
GetDriveTypeA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFullPathNameW
InitializeCriticalSectionAndSpinCount
InterlockedExchange
SetConsoleCtrlHandler
VirtualQuery
FatalAppExitA
HeapCreate
GetModuleHandleA
GetStartupInfoA
GetFileType
GetStdHandle
SetFilePointer
GlobalReAlloc
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
SetLastError
RaiseException
lstrlenW
GlobalUnlock
GlobalFree
FreeResource
LockResource
SizeofResource
FindResourceW
MulDiv
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
lstrcpyW
lstrcpynW
LocalAlloc
lstrcmpW
LocalFree
GetFileSize
GetCurrentThread
OpenProcess
TerminateProcess
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
ExpandEnvironmentStringsW
GetPrivateProfileIntW
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
InitializeCriticalSection
GetModuleFileNameW
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetSystemTimeAsFileTime
CreateThread
ExitThread
GetStartupInfoW
MoveFileA
GetDriveTypeW
lstrlenA
DebugBreak
CreateFileW
GetLocalTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateDirectoryW
WriteFile
RtlUnwind
HeapSize
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
ReadFile
SetFileAttributesW
DeleteFileW
FindNextFileW
GetModuleFileNameA
FindClose
GetProcessHeap
GetTickCount
HeapFree
CompareFileTime
HeapAlloc
FindFirstFileW
HeapReAlloc
ExitProcess
CreateProcessW
WaitForSingleObjectEx
GetVersionExW
GetSystemInfo
ProcessIdToSessionId
WritePrivateProfileStringW
GetWindowsDirectoryW
GetFileAttributesW
GetCurrentProcessId
WinExec
InterlockedDecrement
GetModuleHandleW
LoadResource

user32

InvalidateRect
OffsetRect
ReleaseDC
GetDC
LoadIconW
SetCursor
LoadCursorW
PtInRect
UpdateWindow
PostMessageW
SendMessageW
DrawTextW
DrawIconEx
LoadImageW
FillRect
GetClassLongW
SetTimer
BeginPaint
EndPaint
ScreenToClient
GetCursorPos
WindowFromPoint
MapWindowPoints
ReleaseCapture
GetCapture
SetCapture
IntersectRect
TranslateMessage
SetRect
GetWindowDC
MonitorFromPoint
DestroyMenu
GetSubMenu
LoadMenuW
TrackPopupMenu
PostQuitMessage
RedrawWindow
GetSystemMetrics
IsDialogMessageW
IsWindow
CharNextW
GetClientRect
DestroyWindow
ShowWindow
PeekMessageW
GetMessageW
CreateDialogIndirectParamW
DispatchMessageW
DestroyIcon
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetWindowLongW
GetDlgItem
DialogBoxIndirectParamW
CallWindowProcW
DefWindowProcW
wsprintfW
SetWindowTextW
EndDialog
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
SetWindowPos
AdjustWindowRectEx
GetWindowLongW
KillTimer
MessageBoxW
GetActiveWindow
MessageBoxA
UnregisterClassA

gdi32

SetTextColor
ExtCreateRegion
CombineRgn
CreateFontIndirectW
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
DeleteDC
SetStretchBltMode
StretchBlt
GetStockObject
DeleteObject
CreateDIBSection
GetObjectW
SelectObject
TextOutW
SetBkMode
GetTextColor
GetClipBox
ExcludeClipRect
IntersectClipRect
SetViewportOrgEx
OffsetViewportOrgEx
BitBlt

advapi32

GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
QueryServiceConfigW
ControlService
UnlockServiceDatabase
MakeSelfRelativeSD
GetSecurityDescriptorSacl
SetSecurityInfo
GetSecurityDescriptorOwner
QueryServiceStatusEx
EnumServicesStatusW
ChangeServiceConfigW
QueryServiceStatus
RegRestoreKeyW
GetSecurityInfo
ChangeServiceConfig2W
GetSecurityDescriptorLength
LockServiceDatabase
GetSecurityDescriptorControl
QueryServiceConfig2W
OpenServiceW
MapGenericMask
GetServiceKeyNameW
EnumDependentServicesW
OpenSCManagerW
CloseServiceHandle
CreateServiceW
StartServiceW
RegSaveKeyW
RegOpenKeyW
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
ShellExecuteW

ole32

OleInitialize
OleUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

VarUI4FromStr
SysFreeString

crashreport

Initialize

shlwapi

SHGetValueW
PathFileExistsW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipDrawString
GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectI
GdipCreateSolidFill
GdipDrawImageRectRect

crypt32

CryptQueryObject
CryptMsgGetParam
CryptDecodeObject
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CertFindCertificateInStore
CertGetNameStringW

psapi

GetModuleBaseNameW
EnumProcessModules
GetModuleFileNameExW

aclui

ord2

Sections

.text
Size: 595KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8167f0f814162fc811ac0ab3687603d5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

88:8d:50:a1:67:90:eb:69:a7:21:be:4b:84:d7:ad:c4:08:ec:72:99Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crashreport

shlwapi

comctl32

msimg32

gdiplus

crypt32

psapi

aclui

Sections

.text Size: 595KB - Virtual size: 595KB

.rdata Size: 116KB - Virtual size: 115KB

.data Size: 14KB - Virtual size: 23KB

.rsrc Size: 134KB - Virtual size: 134KB

.reloc Size: 25KB - Virtual size: 25KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

88:8d:50:a1:67:90:eb:69:a7:21:be:4b:84:d7:ad:c4:08:ec:72:99
Signer

.text
Size: 595KB - Virtual size: 595KB

.rdata
Size: 116KB - Virtual size: 115KB

.data
Size: 14KB - Virtual size: 23KB

.rsrc
Size: 134KB - Virtual size: 134KB

.reloc
Size: 25KB - Virtual size: 25KB