2024-03-02_e665b7c166e5cef984e2fefd02f975d9_magniber_virut

Sharing

Copy URL Twitter E-mail

General

Target
2024-03-02_e665b7c166e5cef984e2fefd02f975d9_magniber_virut
Size 2.6MB
Sample240302-qa75badh96
SHA256 2a049dfe18c0dee9c52ac14e0cb5c26d12596b21167038642b834e0749f79b1a
MD5 e665b7c166e5cef984e2fefd02f975d9
SHA1 04e416543be6d7684da1c2bfab6fafdb8a164f7d
SHA512 8294e36e5846017f54e8cedf73b144d196d843583061f3547e16fdb4073d89883c1f94bcb32105317ec4ced304015dc266116df210c308e5662f1f17eddb66b2
SSDEEP 49152:XwwwwsK8PctqFnNkE0shLvQqjw4zkHmbuSHVufjs1VZeJlADT3rMa:f/qFn6E0xqjw4gGbucVursVZeTqrMa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-03-02_e665b7c166e5cef984e2fefd02f975d9_magniber_virut

.exe 2.6MB

2024-03-02_e665b7c166e5cef984e2fefd02f975d9_magniber_virut

IMPHASH b7028fbe1e525fe4a4818ae1aa46b97e
SHA256 2a049dfe18c0dee9c52ac14e0cb5c26d12596b21167038642b834e0749f79b1a
MD5 e665b7c166e5cef984e2fefd02f975d9
SHA1 04e416543be6d7684da1c2bfab6fafdb8a164f7d
SHA512 8294e36e5846017f54e8cedf73b144d196d843583061f3547e16fdb4073d89883c1f94bcb32105317ec4ced304015dc266116df210c308e5662f1f17eddb66b2
SSDEEP 49152:XwwwwsK8PctqFnNkE0shLvQqjw4zkHmbuSHVufjs1VZeJlADT3rMa:f/qFn6E0xqjw4gGbucVursVZeTqrMa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

18:db:f7:f7:65:51:ef:8d:34:d5:0f:b1:a6:c4:64:d2:c3:64:84:ad:72:18:f4:f5:72:7b:da:58:87:5d:16:f8

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Aug 27, 2023

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

86:bc:56:cb:c3:c6:ba:5e:41:57:4e:3a:b4:10:96:a5:d3:d5:9b:26

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Aug 27, 2023

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2793791

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_personal_20230727_branch\Build\Release\WPSOffice\office6\KUninstall.pdb

kernel32

VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount lstrlenW GetFileSize FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW DeleteFileW SetEndOfFile SetFilePointer SetFilePointerEx WriteFile GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileExW GetStdHandle ReadFile MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetModuleHandleW GetProcAddress MoveFileW GetModuleHandleA CompareFileTime GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask VerSetConditionMask VerifyVersionInfoW FreeLibrary LoadLibraryExW GetPrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW LocalFree ExpandEnvironmentStringsW GetFileAttributesExW Sleep TerminateProcess OpenProcess GetSystemWow64DirectoryW LoadLibraryW lstrcmpW FreeResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetPrivateProfileIntW WritePrivateProfileStringW ReleaseMutex OpenEventW OpenFileMappingW GetCurrentThread GetDateFormatW GetTimeFormatW ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread GetLocalTime FileTimeToLocalFileTime GetLongPathNameW QueryDosDeviceW ProcessIdToSessionId GetModuleFileNameW FileTimeToSystemTime WaitForMultipleObjects OutputDebugStringW GetNativeSystemInfo IsWow64Process GetCommandLineW GetEnvironmentVariableW MapViewOfFileEx lstrcmpiW GetSystemDefaultLCID TerminateThread GetLocaleInfoW GetUserDefaultUILanguage GetModuleHandleExW SetErrorMode GetThreadTimes VirtualProtect VirtualQuery LoadLibraryExA GetFileSizeEx GetSystemTime SystemTimeToTzSpecificLocalTime SystemTimeToFileTime CreateFileA DeviceIoControl LoadLibraryA OpenThread SetThreadPriority GetThreadPriority SuspendThread GetThreadContext FlushInstructionCache VirtualProtectEx WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW GetStringTypeW TryEnterCriticalSection EncodePointer GetCPInfo SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW InterlockedPopEntrySList InterlockedPushEntrySList RtlUnwind InterlockedFlushSList ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA GetFileType WriteConsoleW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleCP GetConsoleMode ReadConsoleW FlushFileBuffers FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SignalObjectAndWait GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber RegisterWaitForSingleObject UnregisterWait DuplicateHandle QueryDepthSList UnregisterWaitEx CreateTimerQueue

Sharing

General

Malware Config

Signatures

File Explorer

2024-03-02_e665b7c166e5cef984e2fefd02f975d9_magniber_virut

PE Signature issue

PE Signature issue

kernel32

generic