2024-01-06_ea15a43a2239365be86c787eb588163c_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-06_ea15a43a2239365be86c787eb588163c_magniber
Size

6.4MB
MD5

ea15a43a2239365be86c787eb588163c
SHA1

3e5a822c077370784c44aa58a98b458c7346b612
SHA256

c7f0eda173e3ab19bd7dbf7a43ee1045d50b4b280e6e2796793084e7106aa514
SHA512

0fcc3fc1ff942d246af9315c66bee9eb81ab00e07017bed75d57efacd41d336a26805e7cb4e40190690f2eb9134c235dbbb14e99df5295d3fb672c851d0cc0d9
SSDEEP

98304:Tk5szkssQBP382QTKdQSV9EsAR1DllYXS8OjyMAErDVlbpZUDVyr/kSgCC7h5i:Tk5AJsOE2QAdyjyIrBFpiDVG/qq

Score

1^/10

Malware Config

Signatures

Files

2024-01-06_ea15a43a2239365be86c787eb588163c_magniber
.exe windows:5 windows x86 arch:x86

a5aebc54e96a020870e454179a008536

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:c4:1b:ca:ab:fe:00:cf:83:6f:57:ac:12:8f:18:10
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

27/11/2015, 00:00

Not After

26/11/2017, 23:59

Subject

CN=TeamSpeak Systems GmbH,O=TeamSpeak Systems GmbH,L=Krün,ST=Bayern,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

c6:d3:f6:77:be:72:22:c4:8f:9b:a1:14:41:cd:8d:d7:6c:8d:5a:f1
Signer

Actual PE Digest

c6:d3:f6:77:be:72:22:c4:8f:9b:a1:14:41:cd:8d:d7:6c:8d:5a:f1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

MiniDumpWriteDump

gdi32

GetObjectA
CreateFontIndirectA
SetTextColor
DeleteObject

user32

RegisterClassExA
PostQuitMessage
TrackPopupMenuEx
LoadIconA
SendMessageA
TranslateMessage
CreateWindowExA
DestroyMenu
DefWindowProcA
GetCursorInfo
GetSubMenu
GetSystemMetrics
DestroyWindow
DispatchMessageA
GetMessageA
LoadMenuA
PtInRect
GetSysColorBrush
GetDlgItem
CreateDialogParamA
SetCursor
SetDlgItemTextA
SendDlgItemMessageA
ClientToScreen
IsDialogMessageA
ShowWindow
LoadCursorA
GetWindowRect
LoadImageA
SetClipboardData
LoadBitmapA
EmptyClipboard
CloseClipboard
GetDlgItemTextA
SetForegroundWindow
OpenClipboard

winmm

timeGetTime

advapi32

SystemFunction036
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
ReadEventLogA
RegQueryValueExA
CloseEventLog
OpenEventLogA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

ws2_32

WSAStartup
WSACleanup
WSAGetLastError
htons
htonl
WSAAddressToStringW
ntohs
WSASetLastError
ntohl
setsockopt
ioctlsocket
getsockopt
WSARecv
getsockname
getpeername
WSASocketW
WSAStringToAddressW
listen
shutdown
WSASend
closesocket
bind
WSARecvFrom
WSASendTo
select
WSAIoctl
__WSAFDIsSet
freeaddrinfo
recv
connect
socket
send
getaddrinfo
WSAEnumProtocolsW

mswsock

GetAcceptExSockaddrs
AcceptEx

shell32

Shell_NotifyIconA
SHGetFolderPathA
ShellExecuteA

kernel32

DeviceIoControl
DeleteFileW
GetFileAttributesW
RemoveDirectoryW
FindFirstFileW
CreateDirectoryW
GetFileAttributesExW
SystemTimeToFileTime
HeapSize
WriteConsoleW
CreateFileW
SetStdHandle
FindFirstFileExA
GetCommandLineW
GetCommandLineA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
ReadConsoleW
GetConsoleMode
MoveFileExW
GetFileTime
AreFileApisANSI
FindNextFileW
OpenEventA
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
GetModuleFileNameA
GetStdHandle
HeapReAlloc
ReadFile
ResumeThread
ExitThread
GetModuleHandleExW
ExitProcess
RtlUnwind
CreateIoCompletionPort
LoadLibraryW
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
GetCurrentProcess
lstrlenA
GetCurrentThreadId
CreateFileA
CloseHandle
FreeConsole
lstrcpynA
GetCurrentProcessId
AllocConsole
SetUnhandledExceptionFilter
OutputDebugStringA
GetModuleHandleA
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
GetLastError
TlsAlloc
TlsFree
WaitForSingleObjectEx
SetEvent
WideCharToMultiByte
CreateEventA
HeapFree
HeapAlloc
GetProcessHeap
SetWaitableTimer
TlsSetValue
VerifyVersionInfoA
SetLastError
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
MultiByteToWideChar
TerminateThread
QueueUserAPC
DeleteCriticalSection
VerSetConditionMask
VerifyVersionInfoW
TlsGetValue
GetSystemInfo
CreateWaitableTimerA
SleepEx
LoadLibraryA
GetProcAddress
GetFileSizeEx
FindFirstFileA
FindNextFileA
SetEndOfFile
FindClose
CreateMutexA
UnmapViewOfFile
SwitchToThread
SetFilePointerEx
CreateFileMappingA
LocalFree
RemoveDirectoryA
CreateDirectoryA
MapViewOfFileEx
GetProcessTimes
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
GetTickCount
WriteFile
ReleaseMutex
Sleep
FormatMessageA
SetThreadPriority
GetCurrentThread
FormatMessageW
EncodePointer
DecodePointer
RaiseException
TryEnterCriticalSection
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventW
GetModuleHandleW
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 522KB - Virtual size: 521KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5aebc54e96a020870e454179a008536

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

7c:c4:1b:ca:ab:fe:00:cf:83:6f:57:ac:12:8f:18:10Certificate

Extended Key Usages

Key Usages

c6:d3:f6:77:be:72:22:c4:8f:9b:a1:14:41:cd:8d:d7:6c:8d:5a:f1Signer

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

gdi32

user32

winmm

advapi32

ws2_32

mswsock

shell32

kernel32

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 522KB - Virtual size: 521KB

.data Size: 3.2MB - Virtual size: 3.2MB

.gfids Size: 5KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 105KB - Virtual size: 104KB

.reloc Size: 118KB - Virtual size: 117KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

7c:c4:1b:ca:ab:fe:00:cf:83:6f:57:ac:12:8f:18:10
Certificate

c6:d3:f6:77:be:72:22:c4:8f:9b:a1:14:41:cd:8d:d7:6c:8d:5a:f1
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 522KB - Virtual size: 521KB

.data
Size: 3.2MB - Virtual size: 3.2MB

.gfids
Size: 5KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 105KB - Virtual size: 104KB

.reloc
Size: 118KB - Virtual size: 117KB