Magnify[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Magnify.exe
Size

504KB
MD5

4e5e8ab7fdc1933f43031b9cc13e7198
SHA1

6cb25806014127da1450b9d2808c527b49344b82
SHA256

07aaee0aa8107db066504e9110b0c2b2ea9856b139f0fcf9fccc00fba90ab2ea
SHA512

2c2ec8362d656147c97b39f8b278f43ece34b46df7339ec792b8fef49a1ee9117dac81e605bbd481eaa9891ca06dbadde5bec5c3d0d7aa28e57b541c4bcf97fb
SSDEEP

6144:7tVu5dILp9Ms7XG3M84wn1LDOrX/g8cnsiRV+TL1blDjcjbhmPxlQ2RZuPHegzyP:7m56Ks6F1LqrtY7kDGbhmVRZSel

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Magnify.exe

Files

Magnify.exe
.exe windows:10 windows x86

91b1db750fba961cbddd26628a2c9415

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventRegister
EventWriteTransfer
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegDeleteKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegGetValueW
EventSetInformation
RegEnumValueW
RegNotifyChangeKeyValue
RegLoadMUIStringW
RegQueryValueW
RegEnumKeyExW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegDeleteTreeW
RegQueryValueExW

kernel32

GetTickCount64
SetProcessShutdownParameters
RegisterApplicationRestart
CreateEventExW
DeleteCriticalSection
InitializeCriticalSectionEx
TerminateProcess
GetCurrentProcess
ReleaseMutex
EnterCriticalSection
LeaveCriticalSection
RaiseException
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateMutexW
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
WaitForSingleObjectEx
QueryPerformanceCounter
GlobalAddAtomW
GlobalDeleteAtom
SetEvent
GetUserDefaultLCID
LoadLibraryExW
FreeLibrary
WaitForMultipleObjects
ResetEvent
MultiByteToWideChar
Sleep
HeapSetInformation
OpenMutexW
CompareStringW
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
CreateMutexExW
GetProcAddress
HeapAlloc
CloseHandle
ReleaseSRWLockShared
OpenSemaphoreW
HeapDestroy
HeapReAlloc
HeapSize
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
OutputDebugStringW
GetLastError
QueryPerformanceFrequency
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
FormatMessageW
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
SizeofResource
CompareStringOrdinal
OpenJobObjectW
IsProcessInJob
ProcessIdToSessionId
LockResource
CreateThread
FindResourceExW
LoadResource
OOBEComplete
GlobalAlloc
GetLocaleInfoEx
LocalFree
ExpandEnvironmentStringsW
OpenProcess
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
CreateProcessW
DeleteProcThreadAttributeList
GetFileAttributesW
DeleteFileW
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameW
InitOnceBeginInitialize
InitOnceComplete
VirtualProtect
LoadLibraryExA
GetSystemInfo
VirtualQuery
InitializeCriticalSection
InterlockedPushEntrySList

gdi32

FillRgn
GetObjectW
CreateCompatibleDC
DeleteDC
LineTo
MoveToEx
SelectObject
GetStockObject
CreateSolidBrush
CreateBrushIndirect
CreateBitmap
DeleteObject
CombineRgn
CreateRectRgn

user32

DestroyCursor
UpdateLayeredWindow
GetPointerFrameInfoHistory
GetPointerInfo
UnregisterClassA
SetFullscreenMagnifierOffsetsDWMUpdated
GetDpiForWindow
AdjustWindowRectExForDpi
GetWindowTextW
GetWindowThreadProcessId
ShowWindow
InvalidateRect
GetCursorPos
SetWindowRgn
SetWindowPos
GetSysColor
GetClientRect
SetWinEventHook
SetLayeredWindowAttributes
LoadCursorW
SetActiveWindow
EndPaint
BeginPaint
GetPointerDeviceRects
GetParent
UnhookWinEvent
SetWindowLongW
InflateRect
SetRect
GetForegroundWindow
DefWindowProcW
SetSystemCursor
RegisterClassExW
LoadImageW
RegisterPointerDeviceNotifications
CreateWindowExW
GetPhysicalCursorPos
DestroyWindow
IsWindow
ClipCursor
EnumDisplayMonitors
KillTimer
SystemParametersInfoW
SetTimer
GetProcessDefaultLayout
GetPointerDevices
CopyRect
GetMonitorInfoW
MonitorFromPoint
SendInput
PtInRect
GetFocus
SetFocus
GetKeyState
GetShellWindow
SendNotifyMessageW
GetWindowRgn
UnregisterHotKey
RegisterHotKey
GetKeyboardLayout
SetDesktopColorTransform
IsIconic
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
OpenInputDesktop
UpdateWindow
GetWindow
AdjustWindowRectEx
IsWindowVisible
SendMessageW
MapVirtualKeyExW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
WindowFromPhysicalPoint
MonitorFromRect
OffsetRect
IsRectEmpty
GetWindowRect
GetDesktopWindow
EqualRect
ReleaseDC
GetDC
RegisterClassW
FillRect
SetCursor
GetMessagePos
RemovePropW
SetPropW
SetWindowPlacement
RealGetWindowClassW
GetDoubleClickTime
SendMessageTimeoutW
SetRectEmpty
UnionRect
IntersectRect
GetAncestor
GetWindowLongW
GetClassNameW
LoadIconW
GetGUIThreadInfo
GetSystemMetrics
UnhookWindowsHookEx
SetWindowsHookExW
LoadStringW
CallNextHookEx
PostMessageW
FindWindowW
GetAsyncKeyState
CloseDesktop
GetUserObjectInformationW
GetThreadDesktop
MapWindowPoints
SetPhysicalCursorPos

msvcp_win

?_Xlength_error@std@@YAXPBD@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
_Thrd_join
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
_Thrd_id
_Mtx_unlock
_Mtx_lock
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o___stdio_common_vswscanf
_o__beginthreadex
_o__callnewh
_o__cexit
_o__CIatan2
_o__CIcos
_o__CIfmod
_o__CIlog
_o__CIpow
_o__CIsin
_o__CIsqrt
_o__configthreadlocale
_o__configure_wide_argv
_o__controlfp_s
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__hypot
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__ltow_s
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wtoi
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcstok
_o_wcstok_s
_except_handler4_common
_CxxThrowException
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler3
wcschr
wcsrchr
memcmp
memcpy
_o___stdio_common_vsnprintf_s
memmove

api-ms-win-crt-string-l1-1-0

wcscspn
memmove_s
wcsspn
memset
wcsncmp

ole32

CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx
CoCreateFreeThreadedMarshaler
CoIncrementMTAUsage
CoWaitForMultipleObjects
RoGetAgileReference
CoInitialize

oleacc

AccessibleObjectFromEvent
AccessibleObjectFromWindow

comctl32

InitCommonControlsEx
ord17

oleaut32

SafeArrayCreate
SafeArrayPutElement
SafeArrayDestroy
SysAllocString
VariantInit
VariantClear
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayGetVartype
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SysStringLen

gdiplus

GdipDrawLine
GdipDeletePen
GdipCreatePen1
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipFillRectangle
GdipCloneBrush
GdipAlloc
GdipCreateFontFamilyFromName
GdipDeleteBrush
GdipDeleteFont
GdipSetTextRenderingHint
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipDeleteFontFamily
GdipFree
GdipCreateFont
GdipStringFormatGetGenericTypographic
GdipDrawString

shell32

SHGetKnownFolderPath
SHAppBarMessage
ShellExecuteW

ntdll

WinSqmAddToStream
NtQueryWnfStateData
WinSqmSetDWORD
WinSqmIsOptedIn
RtlPublishWnfStateData
WinSqmIncrementDWORD

dwmapi

DwmIsCompositionEnabled
DwmSetWindowAttribute

magnification

MagUninitialize
MagInitialize
MagSetInputTransform
MagSetLensUseBitmapSmoothing
MagSetWindowTransform
MagSetWindowSource
MagSetFullscreenUseBitmapSmoothing
MagSetFullscreenColorEffect
MagSetFullscreenTransform
MagShowSystemCursor

uiautomationcore

UiaClientsAreListening
UiaRaiseStructureChangedEvent
UiaRaiseAutomationEvent
UiaReturnRawElementProvider
UiaHostProviderFromHwnd

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-crt-math-l1-1-0

_isnan
_finite

Sections

.text
Size: 460KB - Virtual size: 459KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91b1db750fba961cbddd26628a2c9415

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ole32

oleacc

comctl32

oleaut32

gdiplus

shell32

ntdll

dwmapi

magnification

uiautomationcore

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 460KB - Virtual size: 459KB

.data Size: 5KB - Virtual size: 7KB

.idata Size: 13KB - Virtual size: 13KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 21KB - Virtual size: 20KB

.text
Size: 460KB - Virtual size: 459KB

.data
Size: 5KB - Virtual size: 7KB

.idata
Size: 13KB - Virtual size: 13KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 21KB - Virtual size: 20KB