d:\jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-11_5d919015a39e466ffbc9b4149617a8d0_magniber_sliver.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-11_5d919015a39e466ffbc9b4149617a8d0_magniber_sliver.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-11_5d919015a39e466ffbc9b4149617a8d0_magniber_sliver
-
Size
9.4MB
-
MD5
5d919015a39e466ffbc9b4149617a8d0
-
SHA1
4f38736d6315a670afc1f2d82595b5fcd3aa65a3
-
SHA256
a65c2ade23ad5aae546268dc22e0f9f0d0a31dac71d19e737550fc6cdee17b12
-
SHA512
4e66ba4db4968e609c254359d7d12d44ec44f18d645168c3c78e6a62c929f3d404758379df2e45f72bfb95a173a90908bce17f4ba4abef395f5785ce22edf301
-
SSDEEP
196608:g/oQ47ZAOgAeS66w958KxcK9076tXL9UA:WoQOZsA+589K2GU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-11_5d919015a39e466ffbc9b4149617a8d0_magniber_sliver
Files
-
2024-03-11_5d919015a39e466ffbc9b4149617a8d0_magniber_sliver.exe windows:6 windows x64 arch:x64
1d8bfbd382ef198f5cb0513e7190e116
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
DeleteCriticalSection
CreateFileW
Sleep
CreateDirectoryW
LocalFree
FormatMessageW
LocalAlloc
HeapAlloc
GetProcessHeap
HeapFree
CallNamedPipeW
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetExitCodeProcess
ReadFile
PeekNamedPipe
TerminateProcess
WaitForSingleObject
ResumeThread
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
GetProcessTimes
OpenProcess
CreateProcessW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
GetTickCount64
SetEndOfFile
SetFilePointer
GetWindowsDirectoryW
GetEnvironmentVariableW
GetTempPathW
RemoveDirectoryW
DeleteFileW
GetModuleHandleW
GetModuleFileNameW
GetNamedPipeServerProcessId
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
CreateEventW
SetEvent
CreateThread
MoveFileExW
DeviceIoControl
MultiByteToWideChar
FindFirstFileW
FindNextFileW
FindClose
FindFirstFileExW
CreateHardLinkW
WriteFile
WaitForMultipleObjects
OpenEventW
DebugBreak
CreateRemoteThread
VerifyVersionInfoW
VerSetConditionMask
GetLongPathNameW
WideCharToMultiByte
CopyFileW
GetVersionExW
GetSystemInfo
CreateToolhelp32Snapshot
Module32FirstW
VirtualQueryEx
IsWow64Process
GetNativeSystemInfo
Process32FirstW
Process32NextW
GetLogicalDriveStringsW
QueryDosDeviceW
GetCurrentThread
FindResourceW
SizeofResource
DecodePointer
LockResource
GetFileInformationByHandle
FlushFileBuffers
GetTickCount
GlobalAlloc
GlobalFree
GetFileSize
GetFileSizeEx
DuplicateHandle
SetThreadPriority
GetCurrentThreadId
SetFileInformationByHandle
SetSearchPathMode
ExpandEnvironmentStringsW
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
GetLocalTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
lstrcmpA
SetFileTime
SetLastError
GetModuleHandleA
GetStdHandle
GetDriveTypeW
GetSystemWindowsDirectoryW
OutputDebugStringW
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentDirectoryW
CreateFileA
FindResourceExW
GetVersionExA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
ResetEvent
ReleaseMutex
CreateMutexW
GetStartupInfoW
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
SetEnvironmentVariableW
SystemTimeToFileTime
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
RaiseException
InitializeCriticalSectionEx
CloseHandle
GetLastError
LoadResource
GetCurrentProcess
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
GetFullPathNameW
AreFileApisANSI
WaitForSingleObjectEx
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
ExitThread
SetConsoleCtrlHandler
GetCommandLineA
GetCommandLineW
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
SetFilePointerEx
HeapReAlloc
SetStdHandle
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
RtlUnwind
authz
AuthzFreeResourceManager
AuthzAccessCheck
AuthzInitializeContextFromSid
AuthzInitializeResourceManager
AuthzFreeContext
Sections
.text Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 608KB - Virtual size: 612KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE