2024-03-10_d40f484e42344e80f33b086974c960e5_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-10_d40f484e42344e80f33b086974c960e5_magniber
Size

5.4MB
MD5

d40f484e42344e80f33b086974c960e5
SHA1

435209f34bd2368b0f99981d731ae7c02b31f4f1
SHA256

6441f71fabb6bfc51ae69ed5029abd3093291c7fc31ca16d7f820f193d8875c0
SHA512

eeee5906961a771fcf8caf6a9899f76255add0d79b58c89ecbd3335b73a8333b0f3ee272bba839baecf838371a18ec59322a506af0823bb5d14ff96e8f1350af
SSDEEP

98304:xwFC+e1UOteFp0IpTX/RCwF9tpyB96TrBhxCheHd00X08pT:xwFC9fteU56rpkUBhxC8HCm

Score

1^/10

Malware Config

Signatures

Files

2024-03-10_d40f484e42344e80f33b086974c960e5_magniber
.exe windows:4 windows x86 arch:x86

daf574f3040b477b1ee15e12a0c73af8

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20-09-2014 00:00

Not After

19-09-2017 23:59

Subject

CN=Simply Super Software,O=Simply Super Software,POSTALCODE=CV10 7ET,STREET=19 Coxs Close,L=Nuneaton,ST=Warwickshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

20-09-2014 00:00

Not After

19-09-2017 23:59

Subject

CN=Simply Super Software,O=Simply Super Software,POSTALCODE=CV10 7ET,STREET=19 Coxs Close,L=Nuneaton,ST=Warwickshire,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0f:68:10:8d:f0:d2:4e:53:a0:f7:18:1a:91:c1:5b:13:b6:70:bb:47:e2:57:dc:92:1d:e1:e6:af:5d:0d:a8:8e
Signer

Actual PE Digest

0f:68:10:8d:f0:d2:4e:53:a0:f7:18:1a:91:c1:5b:13:b6:70:bb:47:e2:57:dc:92:1d:e1:e6:af:5d:0d:a8:8e

Digest Algorithm

sha256

PE Digest Matches

true

1a:97:06:53:7b:2c:b8:17:31:97:95:b8:65:37:a0:70:f5:aa:f5:b6
Signer

Actual PE Digest

1a:97:06:53:7b:2c:b8:17:31:97:95:b8:65:37:a0:70:f5:aa:f5:b6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

VirtualProtectEx
GetLastError
CreateMutexA
ContinueDebugEvent
ResumeThread
OutputDebugStringA
OutputDebugStringW
SetThreadContext
GetThreadContext
WaitForDebugEvent
WriteProcessMemory
UnmapViewOfFile
InitializeCriticalSection
FreeConsole
CreateThread
SuspendThread
DebugActiveProcess
SetEnvironmentVariableA
GetCurrentProcessId
MapViewOfFile
DuplicateHandle
GetCurrentProcess
CreateFileMappingA
GetVersionExA
GetProcAddress
LoadLibraryA
GetEnvironmentVariableA
VirtualProtect
VirtualAlloc
SetLastError
ReleaseMutex
WaitForSingleObject
OpenMutexA
SetErrorMode
GetShortPathNameA
GetModuleFileNameA
GetShortPathNameW
GetModuleFileNameW
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
IsBadReadPtr
GlobalAddAtomA
GlobalAddAtomW
GlobalFree
GlobalGetAtomNameA
GlobalDeleteAtom
GlobalGetAtomNameW
SetFilePointer
CreateFileA
ExitProcess
GetLocalTime
MultiByteToWideChar
SearchPathA
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
GetWindowsDirectoryA
GetPrivateProfileStringA
EnterCriticalSection
DeleteFileA
MoveFileA
CreateProcessA
GetStartupInfoA
GetCommandLineA
GetCurrentThreadId
ReadFile
GetFileSize
GetProcessHeap
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
LoadLibraryW
FreeLibrary
SetConsoleCtrlHandler
FatalAppExitA
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
GetLocaleInfoW
GetStdHandle
WriteFile
IsProcessorFeaturePresent
CompareStringW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
LCMapStringW
HeapAlloc
GetDateFormatA
GetTimeFormatA
GetModuleHandleW
HeapFree
GetSystemTimeAsFileTime
GetStartupInfoW
RaiseException
RtlUnwind
ReadProcessMemory
LeaveCriticalSection
GetExitCodeProcess
GetCurrentThread
SetThreadPriority
Sleep
GetTickCount
VirtualQueryEx
CreateEventA
SetEvent
CloseHandle
GetModuleHandleA
WritePrivateProfileStringA
GetCommandLineW
FormatMessageA
LocalFree
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
DeleteCriticalSection
SetEndOfFile
SetFilePointerEx
CreateFileW
FindClose
RemoveDirectoryW
DeleteFileW
DeviceIoControl
GetFullPathNameW
FindFirstFileW
FindNextFileW
GetFileAttributesW
CreateDirectoryExW
CopyFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFileInformationByHandle
GetFileAttributesExW
GetFileTime
SetFileTime
MoveFileExW
GetDiskFreeSpaceExW
CreateDirectoryW
AreFileApisANSI

user32

BeginPaint
EndPaint
KillTimer
GetAsyncKeyState
DefDlgProcA
DrawTextA
CreateDialogParamA
RegisterClassExA
DialogBoxParamA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetDlgItem
CreateDialogIndirectParamA
ShowWindow
UpdateWindow
InSendMessage
UnpackDDElParam
DefWindowProcW
DefWindowProcA
LoadCursorA
RegisterClassW
CreateWindowExW
RegisterClassA
CreateWindowExA
GetWindowThreadProcessId
SendMessageW
PeekMessageA
EnumWindows
IsWindowUnicode
PackDDElParam
PostMessageW
PostMessageA
IsWindow
LoadStringA
LoadStringW
FindWindowA
DestroyWindow
GetDesktopWindow
GetSystemMetrics
MoveWindow
SendMessageA
SetPropA
EnumThreadWindows
GetPropA
WaitForInputIdle
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
MessageBoxA
FreeDDElParam

gdi32

SelectObject
BitBlt
DeleteObject
CreatePalette
CreateDCA
SelectPalette
RealizePalette
CreateDIBitmap
DeleteDC
CreateCompatibleDC

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Sections

.plvd
Size: - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eyhrox
Size: - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qrba
Size: - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 440KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.wroblg
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 80B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hnzm
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bxmwc
Size: - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.lfvs
Size: 752KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.cyke
Size: 52KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.yneis
Size: 132KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xwhjd
Size: 40KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bkrq
Size: 4.0MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bowm
Size: 400KB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

daf574f3040b477b1ee15e12a0c73af8

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96Certificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

0f:68:10:8d:f0:d2:4e:53:a0:f7:18:1a:91:c1:5b:13:b6:70:bb:47:e2:57:dc:92:1d:e1:e6:af:5d:0d:a8:8eSigner

1a:97:06:53:7b:2c:b8:17:31:97:95:b8:65:37:a0:70:f5:aa:f5:b6Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

shell32

Sections

.plvd Size: - Virtual size: 4.2MB

.eyhrox Size: - Virtual size: 17KB

.qrba Size: - Virtual size: 93KB

.bss Size: - Virtual size: 440KB

.wroblg Size: - Virtual size: 21KB

.tls Size: - Virtual size: 80B

.hnzm Size: 4KB - Virtual size: 24B

.bxmwc Size: - Virtual size: 263KB

.lfvs Size: 752KB - Virtual size: 768KB

.cyke Size: 52KB - Virtual size: 64KB

.yneis Size: 132KB - Virtual size: 192KB

.xwhjd Size: 40KB - Virtual size: 64KB

.bkrq Size: 4.0MB - Virtual size: 4.1MB

.bowm Size: 400KB - Virtual size: 3.5MB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

cb:ad:56:86:ce:0a:d9:d1:8a:9c:ec:26:f3:ae:86:96
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

0f:68:10:8d:f0:d2:4e:53:a0:f7:18:1a:91:c1:5b:13:b6:70:bb:47:e2:57:dc:92:1d:e1:e6:af:5d:0d:a8:8e
Signer

1a:97:06:53:7b:2c:b8:17:31:97:95:b8:65:37:a0:70:f5:aa:f5:b6
Signer

.plvd
Size: - Virtual size: 4.2MB

.eyhrox
Size: - Virtual size: 17KB

.qrba
Size: - Virtual size: 93KB

.bss
Size: - Virtual size: 440KB

.wroblg
Size: - Virtual size: 21KB

.tls
Size: - Virtual size: 80B

.hnzm
Size: 4KB - Virtual size: 24B

.bxmwc
Size: - Virtual size: 263KB

.lfvs
Size: 752KB - Virtual size: 768KB

.cyke
Size: 52KB - Virtual size: 64KB

.yneis
Size: 132KB - Virtual size: 192KB

.xwhjd
Size: 40KB - Virtual size: 64KB

.bkrq
Size: 4.0MB - Virtual size: 4.1MB

.bowm
Size: 400KB - Virtual size: 3.5MB