2024-02-01_471fa70c7c40535536aff2082ebb84e6_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-01_471fa70c7c40535536aff2082ebb84e6_magniber
Size

1.9MB
MD5

471fa70c7c40535536aff2082ebb84e6
SHA1

33c4ed19e9b70ae648acba2649e5fc9783482a16
SHA256

e85043fa7ac74e9c19ed27b5f81ac333f0dae7eb1d2357c4cf8601ca94d2c8ae
SHA512

96f2e2085d57accd13dead1e2366c08b5509fcc1361d154feb959ee1c9138e988b20b9d7e0d5ec41ea4a71e3f75a80848559c4f560319a9f4fb4e749b258c121
SSDEEP

49152:rktERlzetzBeg2L9S/Fp9B5rRAu9SlPcdORi2RNif0Z9iv71XyEBXOf:rktERlzetzBeg2L9Q9jr2ujORif0Z9A4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-01_471fa70c7c40535536aff2082ebb84e6_magniber

Files

2024-02-01_471fa70c7c40535536aff2082ebb84e6_magniber
.exe windows:6 windows x86 arch:x86

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AdobeIPCBroker.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
SetStdHandle
GetEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MoveFileExW
RtlCaptureStackBackTrace
InitializeCriticalSection
DeleteCriticalSection
LCMapStringW
GetCurrentThread
FormatMessageW
LocalReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
TryEnterCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
ExitProcess
GetCommandLineA
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
RaiseException
GetOverlappedResult
ConnectNamedPipe
ReadFile
FindClose
DeleteFileW
GetConsoleMode
WideCharToMultiByte
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
Sleep
WriteFile
GetFileAttributesW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetEnvironmentVariableW
TlsFree
GetTickCount
GetModuleFileNameW
SetDllDirectoryW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineW

user32

PostQuitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyWindow
SetTimer
MsgWaitForMultipleObjectsEx
DefWindowProcW
CreateWindowExW
RegisterClassW
SetWindowLongW
GetWindowLongW
GetShellWindow
EnumWindows
KillTimer
GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW
ConvertStringSidToSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
GetSidSubAuthority
GetLengthSid
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW

ws2_32

htonl
ntohs
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htons
listen
recv
select
send
socket
WSAStartup
WSAGetLastError
__WSAFDIsSet
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

crclient

advapi32

shell32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 628KB - Virtual size: 632KB