Behavioral task
behavioral1
Sample
2024-02-23_3dfb3df4ca9eef2da3251a59c6e642d1_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-23_3dfb3df4ca9eef2da3251a59c6e642d1_magniber.exe
Resource
win10v2004-20240221-en
General
-
Target
2024-02-23_3dfb3df4ca9eef2da3251a59c6e642d1_magniber
-
Size
10.6MB
-
MD5
3dfb3df4ca9eef2da3251a59c6e642d1
-
SHA1
e0a6f2a5d5de1ab6072d81c0512ab3d0e4492530
-
SHA256
c9a92a10036ef443cef0541249c7e753973966db13506d09efc9b71b5b8c78e5
-
SHA512
91c556c0d04f209cc715234ca1e0d9eebb14c5cfe8521f778f5894262a21195bfdf0a44d8861a52758d59669d275f6fac7c4d22eac885973bffa948df01a4977
-
SSDEEP
98304:HMFUK+hzGOWwfOFHnY51RDJ6hXl2Zlxm8pNey4RWHIYH77TpvmIm3U1o4Pidz7sx:HMFUbD5MHnY51pm0mzFJeLj9i4nda8
Malware Config
Signatures
-
Detects executables packed with Themida 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Themida -
Privateloader family
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-02-23_3dfb3df4ca9eef2da3251a59c6e642d1_magniber
Files
-
2024-02-23_3dfb3df4ca9eef2da3251a59c6e642d1_magniber.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
p Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 575KB - Virtual size: 575KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.themida Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.import Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ