2024-02-04_6841f14bd87a36891cd147f402a7acec_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-02-04_6841f14bd87a36891cd147f402a7acec_magniber
Size

5.3MB
MD5

6841f14bd87a36891cd147f402a7acec
SHA1

79c06f182fe3be52420717d132041e6ada399223
SHA256

357abe5a0c5318d1cd752aa6f07d6141902e04891366dc5128fe688d3fb454af
SHA512

7920afb179a4573b564030f9789888084574852108167cbd7e5a29af800dc5c1686f21eaff822c4c7bb74a48cb4c1ddbc68e7a9dd7018e436690b777bd007cbb
SSDEEP

98304:yuiXl/Ty1InE9ocqRSqY9pJfOo3NZn8AnkhFh1+UAofRlfF:WXgIE9ohYqYb9OOt8NF+UJfXfF

Score

1^/10

Malware Config

Signatures

Files

2024-02-04_6841f14bd87a36891cd147f402a7acec_magniber
.exe windows:6 windows x86 arch:x86

ef7abb80a926cbe934a5da0bd203f741

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

19/01/2010, 00:00

Not After

18/01/2038, 23:59

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e8:b9:7f:60:ac:8e:d5:bc:25:be:18:27:40:e0:0b:5a
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

27/01/2021, 00:00

Not After

27/01/2022, 23:59

Subject

SERIALNUMBER=1197847210076,CN=Argo Enterpraiz\, OOO,O=Argo Enterpraiz\, OOO,POSTALCODE=195197,STREET=House 3 Lit. A Apt. 52 Zhukova Street,L=Sankt-Peterburg,C=RU,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025255

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/12/2014, 00:00

Not After

02/12/2029, 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:ef:78:ee:98:72:9a:56:63:5d:11:b2:8e:29:b2:46:8e:7d:3e:ec
Signer

Actual PE Digest

5e:ef:78:ee:98:72:9a:56:63:5d:11:b2:8e:29:b2:46:8e:7d:3e:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\16e162391906fd18\bin\ReleaseMT\tt-sciter-installer.pdb

Imports

kernel32

TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
GetModuleFileNameW
CreateProcessW
GetTempPathW
GetVersionExW
DeleteFileW
GetTempFileNameW
GetWindowsDirectoryW
GetDriveTypeW
QueryDosDeviceW
VirtualFree
lstrlenW
VirtualAlloc
WaitForSingleObject
K32GetProcessImageFileNameW
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetExitCodeProcess
CreateFileW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateDirectoryW
FindFirstFileW
GetFullPathNameW
FindNextFileW
WriteFile
RemoveDirectoryW
FindClose
GetFileAttributesW
LeaveCriticalSection
FindResourceExW
MoveFileExW
VerSetConditionMask
VerifyVersionInfoW
FlushFileBuffers
VirtualQuery
ReadFile
TlsAlloc
SetFilePointer
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
GetFileInformationByHandle
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
GetSystemInfo
GetFileType
WriteConsoleW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleCP
GetConsoleMode
ReadConsoleW
EnterCriticalSection
GetStringTypeW
WideCharToMultiByte
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeThread
GetCurrentThread
SwitchToThread
GetCurrentProcess
Sleep
WaitForSingleObjectEx
DuplicateHandle
CloseHandle
SleepEx
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
ExpandEnvironmentStringsA
FormatMessageA
GetCurrentThreadId
CreateFileA
GetFileAttributesExW
TryEnterCriticalSection
PeekNamedPipe
SetEndOfFile
SetDllDirectoryW
LocalFree
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GetCommandLineW
SizeofResource
FreeLibrary
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
SetFileAttributesW
HeapFree

user32

GetDesktopWindow
GetWindowRect
TranslateMessage
DispatchMessageW
ShowWindow
GetMessageW
wsprintfW

advapi32

RegOpenKeyExW
RegGetValueW
OpenProcessToken
GetTokenInformation
GetAclInformation
GetAce
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
CopySid
GetNamedSecurityInfoW
CryptGenRandom
CryptAcquireContextA
InitializeSid
IsValidSid
AddAce
InitializeAcl
GetLengthSid
CloseServiceHandle
OpenSCManagerW
ControlService
OpenServiceW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
ConvertSidToStringSidW

shell32

SHGetFolderPathW
SHGetKnownFolderPath

ole32

OleUninitialize
OleInitialize
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoInitializeEx

userenv

UnloadUserProfile

rpcrt4

UuidCreate
RpcStringFreeW
UuidToStringW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

wininet

InternetOpenUrlW
InternetCloseHandle
InternetReadFile
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetCrackUrlW
InternetConnectW
HttpQueryInfoW

dbghelp

SymGetModuleBase64
SymGetOptions
SymFunctionTableAccess64
SymSetOptions
StackWalk64
SymInitialize
SymCleanup

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore

ws2_32

getaddrinfo
select
__WSAFDIsSet
freeaddrinfo
ioctlsocket
WSAGetLastError
socket
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup

Sections

.text
Size: 1005KB - Virtual size: 1004KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ef7abb80a926cbe934a5da0bd203f741

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9dCertificate

Key Usages

e8:b9:7f:60:ac:8e:d5:bc:25:be:18:27:40:e0:0b:5aCertificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

5e:ef:78:ee:98:72:9a:56:63:5d:11:b2:8e:29:b2:46:8e:7d:3e:ecSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

userenv

rpcrt4

version

oleaut32

wininet

dbghelp

crypt32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1004KB

.rdata Size: 1.5MB - Virtual size: 1.5MB

.data Size: 20KB - Virtual size: 30KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 47KB - Virtual size: 46KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d
Certificate

e8:b9:7f:60:ac:8e:d5:bc:25:be:18:27:40:e0:0b:5a
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

5e:ef:78:ee:98:72:9a:56:63:5d:11:b2:8e:29:b2:46:8e:7d:3e:ec
Signer

.text
Size: 1005KB - Virtual size: 1004KB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 20KB - Virtual size: 30KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 47KB - Virtual size: 46KB