2024-01-23_9ba5aab6f77e44018942107ec624e94e_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-01-23_9ba5aab6f77e44018942107ec624e94e_magniber
Size

1.1MB
MD5

9ba5aab6f77e44018942107ec624e94e
SHA1

94e6a9398a1eeb359510451dd75803d57d073111
SHA256

1cd7766d36f2563915417e95ccd95fcff0e40f48edef2ab2d5478a9fc21dde45
SHA512

0e0818273d46011723814ab70971e5366fef7d868786bea0ff7d740aa12584e86760a111a8f079bd45766f65a32f61732777e9abe03c860091d46f80589b165f
SSDEEP

24576:vsPO/+XV+gggg80bzqOOsfW7BaS1yQlEQFCjnw6lOIBj4:UX0gggg8RofWFaB7QFmnw6Bj4

Score

1^/10

Malware Config

Signatures

Files

2024-01-23_9ba5aab6f77e44018942107ec624e94e_magniber
.exe windows:6 windows x86 arch:x86

189598c97f6ac87c77f23b0f9f7dc3ad

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:70:9b:11:08:8b:50:17:78:16:af:a6:9b:55:22:c6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/09/2020, 00:00

Not After

10/03/2023, 12:00

Subject

CN=Privax Limited,OU=RE stapler cistodc,O=Privax Limited,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:b0:ca:68:56:d2:47:a0:52:ee:a1:68:cf:ea:2e:a7:79:30:c3:cb:11:2c:eb:9f:94:97:ad:cf:3a:d6:d4:80
Signer

Actual PE Digest

77:b0:ca:68:56:d2:47:a0:52:ee:a1:68:cf:ea:2e:a7:79:30:c3:cb:11:2c:eb:9f:94:97:ad:cf:3a:d6:d4:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

ntdll

RtlUnwind
RtlNtStatusToDosError

kernel32

GetDiskFreeSpaceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeviceIoControl
FindClose
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
GlobalMemoryStatusEx
GetSystemTimes
QueryPerformanceCounter
SetFilePointerEx
GetEnvironmentVariableW
GetTickCount64
RaiseException
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
EnumSystemLocalesW
SetEndOfFile
SetFilePointer
GetFileAttributesExW
GetFileSizeEx
MoveFileExW
SetFileInformationByHandle
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CreateDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
K32GetProcessImageFileNameW
K32GetMappedFileNameW
WaitForSingleObject
SetEvent
CreateEventW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetConsoleMode
GetConsoleOutputCP
GetStdHandle
FreeLibrary
GetModuleHandleExW
GetFileType
SetStdHandle
GetCommandLineA
FreeLibraryAndExitThread
ExitThread
InterlockedPushEntrySList
OutputDebugStringW
LoadLibraryExA
GetProcessHeap
HeapAlloc
HeapFree
LocalFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSetInformation
IsProcessorFeaturePresent
ExitProcess
lstrcpyW
SetDllDirectoryW
GlobalFree
GetTimeZoneInformation
GetSystemInfo
GetProcAddress
WaitForMultipleObjects
GetExitCodeProcess
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FormatMessageA
WaitForSingleObjectEx
GetExitCodeThread
EncodePointer
DecodePointer
LCMapStringEx
ReadConsoleW
GetCPInfo
InitializeCriticalSectionAndSpinCount
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
TerminateThread
CreateThread
GlobalAlloc
GlobalLock
GlobalUnlock
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CreateProcessW
GetPriorityClass
GetProcessTimes
K32GetProcessMemoryInfo
CreateSemaphoreW
ReleaseSemaphore
GetVersionExW
GetModuleFileNameW
LoadLibraryExW
VirtualAlloc
VirtualFree
VirtualProtect
HeapDestroy
HeapReAlloc
TlsFree
LockFileEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetVersion
HeapSize
FindResourceExW
UnlockFileEx
WriteConsoleW
VirtualQuery
GetModuleHandleW
FileTimeToSystemTime
OutputDebugStringA
GetFullPathNameW
ReadFile
GetFileInformationByHandle
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
FlushFileBuffers
GetLastError
WriteFile
CreateFileW
SetLastError
Sleep
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
GetUserDefaultUILanguage
FindFirstFileExW
GetCommandLineW
GetCurrentProcess
InitializeCriticalSectionEx
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
FreeEnvironmentStringsW
SetEnvironmentVariableW
LoadLibraryW

user32

SetTimer
MoveWindow
LoadCursorW
DrawTextW
KillTimer
RegisterWindowMessageW
UpdateWindow
InvalidateRect
BeginPaint
EndPaint
LoadIconW
DispatchMessageW
TranslateMessage
GetMessageW
ReleaseDC
GetDC
DestroyIcon
PostQuitMessage
DestroyWindow
SetFocus
SetWindowPos
SendMessageW
CreateWindowExW
LoadImageW
SystemParametersInfoW
DefWindowProcW
GetWindowLongW
SetWindowLongW
CharLowerW
MessageBoxW
GetSystemMetrics
GetClassInfoExW
RegisterClassExW
PostMessageW
UnregisterClassW
SetWindowTextW
ShowWindow
IsDialogMessageW
IsWindow

advapi32

GetTokenInformation
IsValidSid
GetSidSubAuthority
GetSidSubAuthorityCount
RegQueryValueExW
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
CreateProcessAsUserW
LookupAccountSidW
OpenProcessToken
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
RegCloseKey

shell32

SHGetFolderPathW

comctl32

ord17

gdiplus

GdiplusShutdown
GdipImageGetFrameDimensionsCount
GdipImageSelectActiveFrame
GdipImageGetFrameDimensionsList
GdipCreateFromHDC
GdipImageGetFrameCount
GdipDeleteGraphics
GdipGetPropertyItemSize
GdipLoadImageFromStream
GdipGetImageHeight
GdipGetImageWidth
GdiplusStartup
GdipFree
GdipCloneImage
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipGetPropertyItem

gdi32

DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
SetTextColor
SetBkMode
GetTextExtentPoint32W
SelectObject
CreateFontIndirectW

ole32

CreateStreamOnHGlobal
CoCreateInstance

Exports

Exports

asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2

Sections

.text
Size: 790KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

189598c97f6ac87c77f23b0f9f7dc3ad

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:70:9b:11:08:8b:50:17:78:16:af:a6:9b:55:22:c6Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

77:b0:ca:68:56:d2:47:a0:52:ee:a1:68:cf:ea:2e:a7:79:30:c3:cb:11:2c:eb:9f:94:97:ad:cf:3a:d6:d4:80Signer

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

advapi32

shell32

comctl32

gdiplus

gdi32

ole32

Exports

Exports

Sections

.text Size: 790KB - Virtual size: 790KB

.rdata Size: 182KB - Virtual size: 181KB

.data Size: 37KB - Virtual size: 46KB

.didat Size: 512B - Virtual size: 92B

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 42KB - Virtual size: 41KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:70:9b:11:08:8b:50:17:78:16:af:a6:9b:55:22:c6
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

77:b0:ca:68:56:d2:47:a0:52:ee:a1:68:cf:ea:2e:a7:79:30:c3:cb:11:2c:eb:9f:94:97:ad:cf:3a:d6:d4:80
Signer

.text
Size: 790KB - Virtual size: 790KB

.rdata
Size: 182KB - Virtual size: 181KB

.data
Size: 37KB - Virtual size: 46KB

.didat
Size: 512B - Virtual size: 92B

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 42KB - Virtual size: 41KB