d:\jenkins\workspace\N_MB4_InstallerService\bin\x64\Release\MBAMIService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_df66bed846aa0374a5b839f10c42d394_magniber_sliver.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_df66bed846aa0374a5b839f10c42d394_magniber_sliver.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_df66bed846aa0374a5b839f10c42d394_magniber_sliver
-
Size
9.1MB
-
MD5
df66bed846aa0374a5b839f10c42d394
-
SHA1
a4897e227dccfa2194612e3573f79b64ce915f87
-
SHA256
c411e13724286244bc0a177faa76354287e38a57a6cee768c0733dafc40d4ef4
-
SHA512
37ad7bc7732d24dd78cc44e2251841426b934ec608941bfaa05feb19cbbfdb6615301a284e9b3c70fe4e0c97a01f5ebe998522f2a19385d9ccae69076f38c539
-
SSDEEP
196608:A3qI/3OvzSxACoVoQufEwm7Cti9076PXL9sVQBWG:A3qI/evzSxACofui7Ei2ozB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-11_df66bed846aa0374a5b839f10c42d394_magniber_sliver
Files
-
2024-03-11_df66bed846aa0374a5b839f10c42d394_magniber_sliver.exe windows:6 windows x64 arch:x64
599ef7f5f15c39bda2ab5fc5c0fb9529
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
CloseHandle
GetLastError
GetCurrentProcess
CreateFileW
CallNamedPipeW
HeapAlloc
HeapFree
GetProcessHeap
Sleep
SwitchToThread
GetSystemDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
LocalAlloc
LocalFree
FormatMessageW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
RemoveDirectoryW
GetTempPathW
DeviceIoControl
SetEvent
WaitForSingleObject
CreateEventW
TerminateProcess
GetExitCodeProcess
CreateThread
CreateProcessW
OpenProcess
GetModuleFileNameW
MoveFileExW
MultiByteToWideChar
VerSetConditionMask
VerifyVersionInfoW
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
WideCharToMultiByte
FindResourceExW
SizeofResource
LoadResource
LockResource
GetWindowsDirectoryW
GetLongPathNameW
CopyFileW
GetTickCount
GetModuleHandleW
QueryDosDeviceW
FlushFileBuffers
GlobalAlloc
GlobalFree
LeaveCriticalSection
EnterCriticalSection
GetVersionExW
GetSystemInfo
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32FirstW
VirtualQueryEx
SetFilePointer
GetFileSizeEx
ReadFile
WriteFile
GetFileInformationByHandle
Process32FirstW
Process32NextW
GetLogicalDriveStringsW
GetCurrentThread
GetFileSize
SetSearchPathMode
ExpandEnvironmentStringsW
GetFileAttributesExW
SetFileAttributesW
FindResourceW
GetDriveTypeW
GetSystemWindowsDirectoryW
GetFileAttributesW
GetNamedPipeServerProcessId
DuplicateHandle
SetFileTime
SetEndOfFile
SetLastError
GetModuleHandleA
GetStdHandle
FileTimeToSystemTime
OutputDebugStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetLocalTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetCurrentDirectoryW
UnmapViewOfFile
GetProcessTimes
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
DeleteProcThreadAttributeList
ResumeThread
PeekNamedPipe
GetEnvironmentVariableW
OpenEventW
WaitForMultipleObjects
GetTickCount64
CreateNamedPipeW
GetVersionExA
GetSystemTimeAsFileTime
ResetEvent
ReleaseMutex
CreateMutexW
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetStartupInfoW
GetCurrentThreadId
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetEnvironmentVariableW
SystemTimeToFileTime
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
GetFullPathNameW
AreFileApisANSI
WaitForSingleObjectEx
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
ExitProcess
GetModuleHandleExW
ExitThread
SetConsoleCtrlHandler
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
HeapReAlloc
SetStdHandle
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
SetFileInformationByHandle
RtlUnwind
Sections
.text Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 102KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 167KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 608KB - Virtual size: 612KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE