D:\TamoSys\program\Obj\Release\Game.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_4090cd625df7249fc7c31a63c4b553f3_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_4090cd625df7249fc7c31a63c4b553f3_magniber.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-11_4090cd625df7249fc7c31a63c4b553f3_magniber
-
Size
9.0MB
-
MD5
4090cd625df7249fc7c31a63c4b553f3
-
SHA1
dc9e4915e5f11cc0103c201580cab68264cdbb01
-
SHA256
7389d12a0da2cf5aa290e75c8fa02eac19b1f183076dbbae0d485595b7dd8164
-
SHA512
eaa796cbfb950e1b43cc75f611881e078249ef8a243a99e976f18b02e5ad55b35a07d9dc10c8c645e25da50a4c9f2523989016c029f8f1c498df0848d416da49
-
SSDEEP
196608:uxSktvHs3KbwsmkAy0Oz8Ty+1uF9hDeu8Ma217qcNT+X74wzmcbuAgz:sM2oNzzZ
Malware Config
Signatures
-
Detects executables packed with Enigma 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Enigma -
Detects packed executables observed in Molerats 1 IoCs
resource yara_rule sample INDICATOR_EXE_Packed_Loader -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-11_4090cd625df7249fc7c31a63c4b553f3_magniber
Files
-
2024-03-11_4090cd625df7249fc7c31a63c4b553f3_magniber.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Sections
.text Size: 718KB - Virtual size: 718KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 191KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.enigma1 Size: 7.6MB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 300KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE