2023-08-26_7e78d5e6cf04e8b6a8b16948db11d427_magniber_JC[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2023-08-26_7e78d5e6cf04e8b6a8b16948db11d427_magniber_JC.exe
Size

2.5MB
MD5

7e78d5e6cf04e8b6a8b16948db11d427
SHA1

22462984726709d56b015f510fc90a8e4971cb4b
SHA256

dc3e90bd3da4a31bde79ec7b71daefdf66bc6478415df88665df6e0ca82f6310
SHA512

d9e1c5bdab3d122da5f632f0cdd3b7af881c2561d28e20a482b61aa53e46984a9cf6cb3d96a5853d2e463ecc2223611c79a76a7acb6497b0054977d7a9e45679
SSDEEP

49152:c2vu9lZe+nd6CsDJtgf1HKnZv+04v8AB6HKMn8IhU:1vu9lZeOpsDPgfOABoxVU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2023-08-26_7e78d5e6cf04e8b6a8b16948db11d427_magniber_JC.exe

Files

2023-08-26_7e78d5e6cf04e8b6a8b16948db11d427_magniber_JC.exe
.exe windows:5 windows x86

03ca02cef3a8de1979df89fd743a2af2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpSetCredentials
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpReadData
WinHttpConnect
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpCrackUrl

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

kernel32

MultiByteToWideChar
Sleep
ReleaseSemaphore
WaitForSingleObject
CloseHandle
CreateSemaphoreW
GlobalFree
DecodePointer
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetComputerNameExW
InterlockedIncrement
InterlockedDecrement
GetVersionExW
GetLocaleInfoA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
SetEnvironmentVariableA
SetEvent
WaitForMultipleObjects
CreateEventW
GetTimeZoneInformation
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTempPathW
lstrlenA
LocalFree
lstrlenW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
FindFirstFileW
SetFilePointer
WriteFile
CreateFileW
lstrcmpW
FindNextFileW
GetCurrentThreadId
DeleteFileW
GetCurrentProcess
GetCurrentThread
FindClose
CreateProcessW
GetDateFormatW
SystemTimeToFileTime
GetTimeFormatW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
GetLocalTime
CreateMutexW
OpenMutexW
ReleaseMutex
LocalAlloc
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
IsDBCSLeadByteEx
GetFileSize
SetEndOfFile
UnlockFileEx
FlushFileBuffers
GetProcAddress
GetSystemTime
GetCurrentProcessId
MoveFileExW
LoadLibraryW
OpenProcess
CopyFileW
GetExitCodeProcess
TerminateProcess
SetLastError
GetFullPathNameW
GetFullPathNameA
CreateFileA
HeapCompact
MapViewOfFile
UnmapViewOfFile
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
GetSystemTimeAsFileTime
FormatMessageA
FormatMessageW
GetFileAttributesA
HeapCreate
HeapValidate
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
GetVersionExA
GetTempPathA
AreFileApisANSI
DeleteFileA
GetStdHandle
GetCommandLineA
WriteConsoleW
DuplicateHandle
SetErrorMode
CreatePipe
CreateEventA
CreateProcessA
GetModuleFileNameA
GetTempFileNameA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetACP
GetModuleHandleExW
ExitProcess
LoadLibraryExW
SetFileTime
FreeLibrary
WideCharToMultiByte
GetEnvironmentVariableA
GetModuleFileNameW
SetStdHandle
GetFileType
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetCurrentDirectoryW
LocalFileTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FindFirstFileExW
GetCommandLineW
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GetStringTypeW
LockFileEx
DebugBreak

user32

MessageBoxW
wsprintfW

advapi32

RegDeleteKeyA
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CryptAcquireContextW
CryptExportKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
RegOpenKeyA
GetUserNameW
RegCreateKeyA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
CreateWellKnownSid
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenThreadToken
OpenProcessToken

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteA
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation

ole32

CoUninitialize
CoInitializeEx
OleRun
CLSIDFromString
CLSIDFromProgID
CoTaskMemFree
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity

oleaut32

SysAllocStringByteLen
GetErrorInfo
VariantClear
SysStringLen
SysAllocString
SysFreeString

shlwapi

PathAddExtensionW
PathAppendW
PathRemoveFileSpecW
PathStripPathW
PathRemoveBackslashW
PathFileExistsW
PathRemoveExtensionW
PathIsDirectoryW
PathIsFileSpecW
PathFindFileNameW
PathRenameExtensionW

Exports

Exports

CSUCheckFBPStatus
GetAsnVersion
IAL_ActivateLicense
IAL_CheckSubscription
IAL_CloseSession
IAL_CreateSession
IAL_DeactivateLicense
IAL_GetAULData
IAL_GetEntitledSerialData
IAL_GetEntitlementsForLEIDS
IAL_GetLEIDForSerial
IAL_GetPackagePoolData
IAL_GetPackagePools
IAL_GetSLConfigData
IAL_GetType2aOfflineException
IAL_GetVersion
IAL_SendAppUsageData
IAL_SendEnrolTrialRequest
IAL_SetCaller
IAL_SetEULAStatus
IAL_SetLicensingLEID
IAL_SetLoggingMethod
IAL_SetProxyDetails
IAL_ValidateSerial
asnInst_InstallerProductInfo_constructor
asnInst_getAsnProductInfo
asnInst_getAsnProductInfoInMem
asn_exit
asn_info
asn_init
asn_makePrivate
asn_makePrivateEx

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 92KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

03ca02cef3a8de1979df89fd743a2af2

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

setupapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 348KB - Virtual size: 347KB

.data Size: 92KB - Virtual size: 118KB

.rsrc Size: 27KB - Virtual size: 26KB

.reloc Size: 160KB - Virtual size: 160KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 348KB - Virtual size: 347KB

.data
Size: 92KB - Virtual size: 118KB

.rsrc
Size: 27KB - Virtual size: 26KB

.reloc
Size: 160KB - Virtual size: 160KB