2024-02-18_f3a99faf0b6b24a8ce136a67cf1c7c3c_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-02-18_f3a99faf0b6b24a8ce136a67cf1c7c3c_magniber
Size 1.1MB
Sample240218-p46mxaab91
SHA256 ffa724f8eb4f9c8521c99372da9b7ba0137d7b60b3406275c26f8e0400b3be73
MD5 f3a99faf0b6b24a8ce136a67cf1c7c3c
SHA1 1ad1748c5b525caa71cf5b029371895d21191eab
SHA512 34b5263a5a459911d88bf828d56f1d89d15c28cacfb7ed0c188a1d19e3e83b0f9f1ea45e4793ebba838273b9d9435c31531892c007f42c992c5c770ecfac5a6e
SSDEEP 24576:g97CreN7inwWTHeIDUpuNIHsARhlUw6C5E+VzP9qEAipxBz:g97NI9UpuyHsAdbvE+d8YxJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-18_f3a99faf0b6b24a8ce136a67cf1c7c3c_magniber

File Explorer

2024-02-18_f3a99faf0b6b24a8ce136a67cf1c7c3c_magniber

.exe 1.1MB

2024-02-18_f3a99faf0b6b24a8ce136a67cf1c7c3c_magniber

IMPHASH 359d7dcb1d7b9dee8c934ad5a754fdaa
SHA256 ffa724f8eb4f9c8521c99372da9b7ba0137d7b60b3406275c26f8e0400b3be73
MD5 f3a99faf0b6b24a8ce136a67cf1c7c3c
SHA1 1ad1748c5b525caa71cf5b029371895d21191eab
SHA512 34b5263a5a459911d88bf828d56f1d89d15c28cacfb7ed0c188a1d19e3e83b0f9f1ea45e4793ebba838273b9d9435c31531892c007f42c992c5c770ecfac5a6e
SSDEEP 24576:g97CreN7inwWTHeIDUpuNIHsARhlUw6C5E+VzP9qEAipxBz:g97NI9UpuyHsAdbvE+d8YxJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

358468

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\416969\out\Release\ShadowTray.pdb

kernel32

SystemTimeToFileTime LocalFileTimeToFileTime WaitForSingleObjectEx CreateWaitableTimerW SetWaitableTimer CancelWaitableTimer GetModuleFileNameW GetShortPathNameW GetLongPathNameW OpenProcess GetCurrentProcessId ReleaseMutex CreateMutexW GetCommandLineW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcAddress LoadLibraryW DecodePointer InterlockedIncrement InterlockedDecrement FreeLibrary SetErrorMode lstrcmpiW LoadLibraryExW GetModuleHandleW GetPrivateProfileIntW WritePrivateProfileStringW DeviceIoControl GetCurrentProcess GetCurrentThread GetProcessId GetFileSize FlushFileBuffers FormatMessageW lstrcpynW lstrlenW GetStartupInfoW GetPrivateProfileStringW GetSystemDirectoryW GetTempPathW GetTempFileNameW GetVersionExW ResumeThread SuspendThread GetExitCodeThread ReadConsoleW WriteConsoleW SetStdHandle OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage GetThreadTimes FindNextFileA FindFirstFileExW FindFirstFileExA FindClose SetConsoleCtrlHandler GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP GetFileType GetACP GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW GetThreadPriority GetThreadPriorityBoost SetLastError CreateProcessW PeekNamedPipe CreatePipe SetHandleInformation ReadFile WriteFile Sleep TerminateThread TerminateProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WideCharToMultiByte LocalFree CreateEventW GetTickCount WaitForMultipleObjects WaitForSingleObject SetEvent InitializeCriticalSectionAndSpinCount GetLastError GetCurrentThreadId RaiseException InterlockedCompareExchange InterlockedExchange DeleteFileW CreateFileW GetLocalTime LockResource CloseHandle GetFileSizeEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MultiByteToWideChar FindResourceExW FindResourceW SizeofResource LoadResource GetProcessHeap HeapSize FreeLibraryAndExitThread ExitThread CreateThread InterlockedFlushSList RtlUnwind GetSystemWindowsDirectoryW FreeResource lstrcmpiA lstrcmpA QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter OpenThread HeapWalk HeapUnlock HeapLock SetFilePointerEx SetEndOfFile CreateFileA GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList HeapFree HeapReAlloc InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent HeapAlloc HeapDestroy LocalAlloc FindNextFileW

user32

GetClassInfoExW CreateWindowExW IsWindow DestroyWindow SetTimer KillTimer GetWindowLongW SetWindowLongW LoadCursorW SendMessageTimeoutW ShowWindow IsWindowVisible wsprintfW WaitForInputIdle UnregisterClassA DefWindowProcW IsIconic CallWindowProcW UnregisterClassW SetForegroundWindow FindWindowExW GetWindowThreadProcessId RegisterWindowMessageW PostMessageW PostQuitMessage GetMessageW RegisterClassExW GetShellWindow ExitWindowsEx CharNextW PeekMessageW DispatchMessageW TranslateMessage

advapi32

OpenThreadToken RegEnumKeyExA RegQueryValueExA CryptAcquireContextW CryptReleaseContext CryptDestroyKey RegQueryValueExW CheckTokenMembership DuplicateTokenEx LookupPrivilegeValueW GetLengthSid FreeSid AllocateAndInitializeSid EqualSid CreateWellKnownSid AdjustTokenPrivileges SetTokenInformation GetTokenInformation OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceLockStatusW QueryServiceConfig2W QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW CryptContextAddRef CryptDecrypt CryptEncrypt CryptImportKey CryptGenRandom CryptSetKeyParam RegOpenKeyExA

shell32

ShellExecuteExW SHCreateDirectoryExW ShellExecuteW SHGetSpecialFolderPathW CommandLineToArgvW SHFileOperationW

ole32

CoUninitialize CLSIDFromProgID CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateGuid CoInitialize CoCreateInstance

oleaut32

VariantClear VariantInit VarUI4FromStr SysFreeString SysAllocString

shlwapi

StrCmpIW SHGetValueA StrStrIA StrToIntExW SHSetValueA StrTrimA StrCmpNIW PathAppendW PathCombineW PathFileExistsW PathRemoveFileSpecW AssocQueryStringW SHSetValueW SHGetValueW SHDeleteValueW PathIsRootW wnsprintfW StrStrIW PathFindFileNameW PathIsRelativeW

comctl32

InitCommonControlsEx

ws2_32

WSAGetLastError select recv send inet_addr htons ioctlsocket connect closesocket __WSAFDIsSet socket

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

psapi

GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

generic

count=17, id=241, version=40116,

count=165, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27035,

count=1, productName=Unmarked objects (old),

count=4, id=261, version=27024,

count=22, id=259, version=26706,

count=8, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=10, id=260, productName=VS2017 v15.8.0 build 26726, version=26726,

count=34, id=260, version=26706,

count=67, id=261, version=26706,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=319, id=1, productName=Unmarked objects,

count=1, id=260, version=27035,

count=25, id=261, version=27035,

count=1, id=255, version=27035,

count=1, id=151,

count=1, id=258, version=27035,