2024-02-16_19fcb3ebad39e882cb8b6eda9ed0d461_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-02-16_19fcb3ebad39e882cb8b6eda9ed0d461_magniber
Size 3.9MB
Sample240216-r2eshscf49
SHA256 2ea66b8fc2108326b629ba5ba00964e19f5f457b2546b2d01ac14f1470b6a6bf
MD5 19fcb3ebad39e882cb8b6eda9ed0d461
SHA1 9b5dd8057555a1316bbcd650fa75a00f4b651a11
SHA512 7efea6178249a0ab9abf1a32e4bdc748447bcd221cd574f0ef308897bba0d4ba501a5b3a953910dda79807db61a23d343f6af7155c9ad645a50420eb1f6a5604
SSDEEP 49152:aNlIBciRNuXuERr0xdRIAOChDJNaSks97KROdp2FUNe/RmX4OOZ5B0s8XgkmWuTk:aNlIB3RNIYGABDJNiOOd0TPmeRILh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-16_19fcb3ebad39e882cb8b6eda9ed0d461_magniber

File Explorer

2024-02-16_19fcb3ebad39e882cb8b6eda9ed0d461_magniber

.exe 3.9MB

2024-02-16_19fcb3ebad39e882cb8b6eda9ed0d461_magniber

IMPHASH 045a65f1f51e960bb83add92db4198fa
SHA256 2ea66b8fc2108326b629ba5ba00964e19f5f457b2546b2d01ac14f1470b6a6bf
MD5 19fcb3ebad39e882cb8b6eda9ed0d461
SHA1 9b5dd8057555a1316bbcd650fa75a00f4b651a11
SHA512 7efea6178249a0ab9abf1a32e4bdc748447bcd221cd574f0ef308897bba0d4ba501a5b3a953910dda79807db61a23d343f6af7155c9ad645a50420eb1f6a5604
SSDEEP 49152:aNlIBciRNuXuERr0xdRIAOChDJNaSks97KROdp2FUNe/RmX4OOZ5B0s8XgkmWuTk:aNlIB3RNIYGABDJNiOOd0TPmeRILh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2058994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Prog\CrashRptRail\bin\rail_crash_sender.pdb

kernel32

GetProcAddress FreeLibrary GetProcessTimes FileTimeToSystemTime GetSystemTime GetFileAttributesW GetCurrentThreadId GetCommandLineW CreateThread GetCurrentProcess ReadFile WriteFile CreateProcessW GetFileInformationByHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId TerminateProcess DeleteFileW RemoveDirectoryW TerminateThread Sleep GetTickCount RaiseException DecodePointer OutputDebugStringA CreateDirectoryW WritePrivateProfileStringW GetModuleHandleExW GetModuleFileNameW GetTempPathW GetPrivateProfileStringW FormatMessageW GetFileAttributesExW GlobalAlloc GlobalFree SystemTimeToFileTime GetModuleHandleW SystemTimeToTzSpecificLocalTime GetTempFileNameW TryEnterCriticalSection CreateMutexA ReleaseMutex OpenFileMappingW UnmapViewOfFile GetSystemInfo CreateFileMappingW MapViewOfFile SetConsoleCtrlHandler WriteConsoleW GetModuleFileNameA GetConsoleMode GetConsoleCP CreateProcessA GetDriveTypeW RtlUnwind WaitForMultipleObjectsEx TzSpecificLocalTimeToSystemTime SetFileTime CopyFileA UnlockFileEx LoadLibraryW ReadProcessMemory OpenProcess FindClose FindNextFileW GetFileTime FindFirstFileW GetFileSizeEx CreateFileW MultiByteToWideChar UnlockFile LockFileEx LockFile GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA CreateTimerQueue UnregisterWaitEx WaitForSingleObject QueryDepthSList InterlockedFlushSList SetEvent InterlockedPushEntrySList LeaveCriticalSection Module32First Process32Next Process32First GetVersionExA GetLocalTime SetFilePointer GenerateConsoleCtrlEvent RtlCaptureStackBackTrace FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA GetProcessHeap HeapSize CreatePipe GetExitCodeProcess FlushFileBuffers GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW ReadConsoleW GetACP HeapReAlloc MoveFileExW GetCurrentDirectoryW GetCurrentDirectoryA SetCurrentDirectoryW SetCurrentDirectoryA SetEnvironmentVariableW SetEnvironmentVariableA GetFullPathNameA GetFullPathNameW HeapFree HeapAlloc SetConsoleMode InterlockedPopEntrySList ReleaseSemaphore ReadConsoleInputA PeekConsoleInputA DuplicateHandle GetNumberOfConsoleInputEvents ResumeThread ExitThread SetProcessAffinityMask ResetEvent EnterCriticalSection CloseHandle CreateEventW VirtualProtect DeleteCriticalSection InitializeCriticalSectionAndSpinCount VirtualFree VirtualAlloc GetLastError WideCharToMultiByte GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle InitializeCriticalSection GetTempPathA GetWindowsDirectoryA GetComputerNameA GetSystemTimeAsFileTime GetModuleHandleA GetFileType SetLastError FormatMessageA SleepEx VerifyVersionInfoA GetSystemDirectoryA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe FindFirstFileA FindNextFileA GlobalMemoryStatus QueryPerformanceCounter FlushConsoleInputBuffer IsDebuggerPresent OutputDebugStringW QueryPerformanceFrequency FindFirstFileExW GetDiskFreeSpaceExW SetEndOfFile SetFileAttributesW SetFilePointerEx CopyFileW CreateHardLinkW AreFileApisANSI GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW ExitProcess

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA UnregisterClassW GetGuiResources ReleaseDC GetDC

shell32

SHGetFileInfoW ExtractIconW CommandLineToArgvW SHGetSpecialFolderPathW SHFileOperationW

ole32

CoCreateGuid CoInitialize CoCreateInstance CoUninitialize

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegEnumValueW RegCloseKey RegQueryValueExW DeregisterEventSource ReportEventA RegisterEventSourceA OpenProcessToken

ws2_32

freeaddrinfo sendto __WSAFDIsSet bind WSAIoctl closesocket WSASetLastError getpeername getsockname socket ntohs connect inet_addr listen accept getaddrinfo recvfrom gethostname getsockopt htons setsockopt send recv WSAGetLastError WSACleanup WSAStartup shutdown getservbyname ioctlsocket gethostbyname select htonl ntohl inet_ntoa

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetProcessMemoryInfo

wldap32

ord143 ord60 ord41 ord33 ord79 ord200 ord27 ord26 ord46 ord22 ord301 ord211 ord35 ord30 ord50 ord32

normaliz

IdnToAscii IdnToUnicode

gdi32

DeleteObject GetDeviceCaps GetDIBits CreateCompatibleBitmap GetObjectA

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

winmm

timeGetDevCaps timeKillEvent timeSetEvent timeBeginPeriod

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

654KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

293KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

207KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=24, id=241, version=40116,

count=206, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=20, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=9, id=199, version=41118,

count=26, id=259, version=24123,

count=125, id=261, version=24123,

count=37, id=260, version=24123,

count=2, id=261, version=23013,

count=6, id=203, version=65501,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=315, id=1, productName=Unmarked objects,

count=654, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,