2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil

General

Target
2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil
Size 5.2MB
Sample240218-x8w82aec99
SHA256 bc5eec6fc9465453794a5a9db3bfea1fd498d6bd1f1428a674a465afe703eb94
MD5 db5bfeaab000128bf8240ee52b2afebf
SHA1 8bb6a1c53d10d2185c17b5c0aa5c3c82cb736f68
SHA512 24dc821dda49a5fe22b69873ca34b5b4a1127f78cceb32b3e5ae505f124566a07c878737ec2734a76d72b7091776667e3f30be1a537fe970c043259d5b584809
SSDEEP 98304:04C9R9eI5Bt5kLqh66mr8RV5mw8vGCNy8+ylESkYkr/f6/lB:0jeKBtWy665kjD1+OEXfM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil

File Explorer

2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil

.exe 5.2MB

2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil

IMPHASH 650d84c5e33252d81c4c94e64cd04262
SHA256 bc5eec6fc9465453794a5a9db3bfea1fd498d6bd1f1428a674a465afe703eb94
MD5 db5bfeaab000128bf8240ee52b2afebf
SHA1 8bb6a1c53d10d2185c17b5c0aa5c3c82cb736f68
SHA512 24dc821dda49a5fe22b69873ca34b5b4a1127f78cceb32b3e5ae505f124566a07c878737ec2734a76d72b7091776667e3f30be1a537fe970c043259d5b584809
SSDEEP 98304:04C9R9eI5Bt5kLqh66mr8RV5mw8vGCNy8+ylESkYkr/f6/lB:0jeKBtWy665kjD1+OEXfM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5439488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v11_i18n_20221215_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA VerSetConditionMask CreateDirectoryW GetDiskFreeSpaceExW GetTempFileNameW GetTempPathW OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW OpenProcess GetVersionExW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemTime GetSystemDirectoryW GetSystemWow64DirectoryW LoadLibraryW GetSystemPowerStatus GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID CreateFileW GetFileAttributesW GetFileSizeEx ReadFile GetCurrentProcess TerminateProcess GetCurrentThreadId GetProcessId GetDateFormatW GetFileInformationByHandle GetFileSize SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc VirtualFree ExitProcess FreeResource lstrcpyW GetLocaleInfoW GetUserDefaultLangID DecodePointer RaiseException InitializeCriticalSectionAndSpinCount SleepEx QueryPerformanceFrequency GetSystemDirectoryA QueryPerformanceCounter SetLastError FormatMessageW MoveFileExA CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoA GetVersionExA ExpandEnvironmentStringsA GetWindowsDirectoryA GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock LocalFree SetFileTime DuplicateHandle DosDateTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentThread ProcessIdToSessionId GetPrivateProfileStringW CreateFileA DeviceIoControl CreateThread GetEnvironmentVariableW CreateEventW GetCompressedFileSizeW ReleaseMutex GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime IsDebuggerPresent OutputDebugStringW GetStringTypeW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetCPInfo CompareStringW LCMapStringW UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA DeleteFileW ExitThread FreeLibraryAndExitThread GetDriveTypeW SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetFullPathNameW SetStdHandle SetEndOfFile GetTimeZoneInformation SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SetConsoleMode ReadConsoleA SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber FindFirstFileW FormatMessageA LockFileEx UnlockFile HeapCompact DeleteFileA WaitForSingleObjectEx FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI TryEnterCriticalSection

Sharing

General

Malware Config

Signatures

File Explorer

2024-02-18_db5bfeaab000128bf8240ee52b2afebf_magniber_revil

kernel32

generic