2024-03-09_edb01fb8b70ad4e0f0dd129b6ffc3c5c_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-09_edb01fb8b70ad4e0f0dd129b6ffc3c5c_magniber
Size

9.9MB
MD5

edb01fb8b70ad4e0f0dd129b6ffc3c5c
SHA1

7b2e69829edec6130a090f73c44639de3acb9eb1
SHA256

1101704ce95422b2274e074330d0c68075214333e2883054bfe39e163442a2fc
SHA512

ad4dd9586eadb0a2358b34a73ce467648c36982a68b56c958dc497505a07e018fc3c656057346db70de7406ad3d3f6c88501fdba30e2b2572e7d2e9c7138e2ae
SSDEEP

98304:tCAV1yYkd+PqGNZL5Velv+lKBO23tVHXfYBF6WT5dfJ5OYC0S6RqjNF1p:0yxK+yGJVel+KBO/YWvR5npRsV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-09_edb01fb8b70ad4e0f0dd129b6ffc3c5c_magniber

Files

2024-03-09_edb01fb8b70ad4e0f0dd129b6ffc3c5c_magniber
.exe windows:6 windows x86 arch:x86

0756aceadabe63ded81982050d8b7931

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Animon\ClientTs\cripto.pdb

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegCloseKey

dbghelp

StackWalk
SymInitialize
SymGetModuleBase
SymFunctionTableAccess
UnDecorateSymbolName
SymGetSymFromAddr
SymCleanup

gdi32

SetPixelFormat
SwapBuffers
DeleteObject
ChoosePixelFormat
GetStockObject
CreateCompatibleBitmap
CreateBitmap

kernel32

GetQueuedCompletionStatus
CreateEventW
VerSetConditionMask
SleepEx
CreateIoCompletionPort
GetModuleFileNameA
Process32First
CreateToolhelp32Snapshot
Process32Next
GetModuleHandleA
Sleep
CreateWaitableTimerA
GetProcAddress
GetCommandLineW
GetCurrentProcess
TerminateProcess
GetProcessId
GetTempPathW
GetFileAttributesW
GetCurrentDirectoryA
OpenProcess
MultiByteToWideChar
GetFileAttributesExW
GetCurrentThread
GlobalAlloc
DeleteFileW
GlobalFree
GetSystemInfo
GetCurrentDirectoryW
GlobalLock
GetCurrentProcessId
GlobalMemoryStatusEx
CopyFileW
WideCharToMultiByte
GlobalUnlock
SetUnhandledExceptionFilter
GetModuleFileNameW
lstrlenW
CreateFileW
ReadFile
WriteFile
PeekNamedPipe
WaitNamedPipeW
LCMapStringEx
DecodePointer
EncodePointer
IsProcessorFeaturePresent
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
MoveFileExW
AreFileApisANSI
DeleteCriticalSection
SetFileInformationByHandle
GetFullPathNameW
GetFileInformationByHandle
GetNativeSystemInfo
GetExitCodeThread
SwitchToThread
SetLastError
GetLocaleInfoEx
CreateSemaphoreA
ReleaseSemaphore
SetThreadPriority
WaitForSingleObjectEx
HeapSize
CreatePipe
GetExitCodeProcess
SetEndOfFile
ResetEvent
DebugBreak
IsDebuggerPresent
GetModuleHandleExA
InitializeCriticalSection
VirtualQuery
LoadLibraryExA
RtlUnwind
RaiseException
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindFirstFileW
LoadLibraryW
ConvertThreadToFiberEx
ConvertFiberToThread
GetACP
GetSystemTimeAsFileTime
CreateFiberEx
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
OutputDebugStringW
HeapFree
HeapAlloc
GetCommandLineA
CreateProcessW
GetConsoleOutputCP
DuplicateHandle
SetEnvironmentVariableW
GetDriveTypeW
ExitProcess
FreeLibraryAndExitThread
ExitThread
WriteConsoleW
SetConsoleCtrlHandler
LoadLibraryExW
InterlockedPushEntrySList
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
CompareStringEx
DeleteFiber
SwitchToFiber
GetEnvironmentVariableW
LocalFree
QueueUserAPC
CloseHandle
TlsAlloc
TerminateThread
SetEvent
GetLastError
PostQueuedCompletionStatus
WaitForSingleObject
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
TlsSetValue
SetWaitableTimer
TlsGetValue
FormatMessageA
TryAcquireSRWLockExclusive
TlsFree
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
RemoveDirectoryW
SetFilePointerEx
CreateFile2
InitializeCriticalSectionEx
CreateThread
GetCurrentThreadId
FreeLibrary
GetModuleHandleW
LoadLibraryA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetModuleHandleExW
GetSystemDirectoryA
GetStdHandle
GetFileType
VirtualAlloc
VirtualProtect
VirtualFree

shell32

ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
SHGetSpecialFolderPathW

user32

GetKeyState
DispatchMessageA
LoadCursorA
DestroyWindow
GetDC
MessageBoxW
GetSystemMetrics
SetWindowTextW
GetWindowPlacement
DestroyCursor
ShowWindow
OpenClipboard
SetWindowLongA
CreateIconIndirect
CloseClipboard
EmptyClipboard
GetWindowLongA
SetWindowPlacement
CreateCursor
MessageBoxA
MoveWindow
RegisterClassA
DefWindowProcA
CreateWindowExA
TranslateMessage
GetClipboardData
SendMessageA
SetCapture
SetClipboardData
SetCursor
LoadIconA
GetClientRect
PeekMessageA
UnregisterClassA
FindWindowA
ShowCursor
ReleaseDC
AdjustWindowRectEx
PostMessageW
SetWindowPos
GetProcessWindowStation
GetUserObjectInformationW

winmm

timeBeginPeriod
timeEndPeriod

opengl32

wglGetCurrentDC
wglMakeCurrent
wglDeleteContext
glEnable
wglCreateContext
glGetIntegerv
glGetString
glTexImage2D
wglGetProcAddress
glClearColor
glDeleteTextures
glTexParameteri
glColorMask
glBlendFunc
glScissor
glGenTextures
glBindTexture
glClear
glViewport
glDisable
glDrawArrays

ws2_32

recv
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
gethostbyname
ntohs
WSAStringToAddressW
WSAAddressToStringW
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
WSASend
send
ntohl
shutdown
listen
WSASetLastError
WSASocketW
getaddrinfo
getpeername
getsockname
socket
WSARecv
getsockopt
htonl
htons
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
WSACleanup
WSAStartup
select
connect

mswsock

AcceptEx
GetAcceptExSockaddrs

bcrypt

BCryptGenRandom

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

ole32

CoTaskMemFree
CoInitializeEx
CoCreateInstance
CoUninitialize
PropVariantClear

Exports

Exports

__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 6.8MB - Virtual size: 6.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 902KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 382KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0756aceadabe63ded81982050d8b7931

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

dbghelp

gdi32

kernel32

shell32

user32

winmm

opengl32

ws2_32

mswsock

bcrypt

crypt32

ole32

Exports

Exports

Sections

.text Size: 6.8MB - Virtual size: 6.8MB

.rdata Size: 1.7MB - Virtual size: 1.7MB

.data Size: 902KB - Virtual size: 1.7MB

_RDATA Size: 10KB - Virtual size: 9KB

.rsrc Size: 63KB - Virtual size: 63KB

.reloc Size: 382KB - Virtual size: 381KB

.text
Size: 6.8MB - Virtual size: 6.8MB

.rdata
Size: 1.7MB - Virtual size: 1.7MB

.data
Size: 902KB - Virtual size: 1.7MB

_RDATA
Size: 10KB - Virtual size: 9KB

.rsrc
Size: 63KB - Virtual size: 63KB

.reloc
Size: 382KB - Virtual size: 381KB