2024-03-12_f411e4a838f782a9a04a4bbfa8b278c2_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-03-12_f411e4a838f782a9a04a4bbfa8b278c2_magniber
Size

29.1MB
MD5

f411e4a838f782a9a04a4bbfa8b278c2
SHA1

a3e7d68e6215d52e3849fbbe1c365c214530e06d
SHA256

46919c240795af6cd04734c2b9270a141ab866787f507926e6dede39ea7311e5
SHA512

2d4c93f20d6a9da3ed499e24fe3ec8edb7d0e6d95ea9870dc0c629f22b2fa15dc61eee12a9c62f330d65726137f548bb53e05aea58df14f8bf9d5ec89c1445c2
SSDEEP

196608:ikdcKKddWyPyNKjt/aTodalkqSZ/Sla+kotPruPy3kr:iU7odLqKSIo0Py3m

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-12_f411e4a838f782a9a04a4bbfa8b278c2_magniber

Files

2024-03-12_f411e4a838f782a9a04a4bbfa8b278c2_magniber
.exe windows:6 windows x86 arch:x86

b90e7c9a25208f5c1767eee264c0af95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\OpenRCT2\OpenRCT2\bin\openrct2-win.pdb

Imports

kernel32

GetSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
QueryPerformanceFrequency
FormatMessageW
lstrcmpiW
GetLastError
LCMapStringEx
MultiByteToWideChar
QueryPerformanceCounter
ReadDirectoryChangesW
CancelIoEx
FindClose
FindNextFileW
SetConsoleMode
CopyFileW
FindFirstFileW
ReadConsoleInputW
SetConsoleTitleW
GetConsoleTitleW
ScrollConsoleScreenBufferW
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
WriteConsoleInputW
WriteConsoleW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetLogicalDrives
GetEnvironmentVariableW
GetDateFormatEx
GetTimeFormatEx
GetModuleHandleW
GetProcAddress
GetStdHandle
GetConsoleMode
HeapFree
GetProcessHeap
lstrcmpW
HeapAlloc
GetCurrentProcess
GetLocaleInfoEx
GetFileAttributesExW
CloseHandle
GetFileTime
CreateFileW
GetModuleFileNameW
FileTimeToSystemTime
HeapSize
SetEndOfFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WideCharToMultiByte
SetConsoleOutputCP
SetConsoleCP
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleOutputCP
FreeLibraryAndExitThread
ExitThread
TlsFree
SetLastError
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
GetStringTypeW
InitializeCriticalSectionEx
DecodePointer
EncodePointer
AcquireSRWLockShared
ReleaseSRWLockShared
GetNativeSystemInfo
GetExitCodeThread
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
FindFirstFileExW
InitOnceComplete
InitOnceBeginInitialize
IsProcessorFeaturePresent
lstrlenW
ReadFile
WriteFile
PeekNamedPipe
WaitNamedPipeW
GetCurrentProcessId
GetFileType
FreeLibrary
LoadLibraryW
CreateFileA
GetFileSizeEx
HeapReAlloc
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
LoadLibraryA
OutputDebugStringW
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
MulDiv
SetThreadExecutionState
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
Sleep
VerSetConditionMask
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
LocalFree
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
GetModuleHandleExW
GetSystemPowerStatus
GetLocaleInfoA
MoveFileExW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
RtlCaptureContext
SetUnhandledExceptionFilter
InitializeCriticalSection
GetProcessId
VirtualQueryEx
SetNamedPipeHandleState
TransactNamedPipe
SetEvent
WaitForMultipleObjects
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
VirtualQuery

user32

GetRawInputDeviceInfoA
GetDesktopWindow
SetWindowRgn
MonitorFromWindow
PostThreadMessageW
CreateIconFromResource
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
GetParent
DialogBoxIndirectParamW
PtInRect
IntersectRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RemovePropW
SetPropW
SetForegroundWindow
SetActiveWindow
GetFocus
SetFocus
FlashWindowEx
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
EndDialog
SendMessageW
LoadIconW
MessageBoxW
GetDlgItem
DrawTextW
SystemParametersInfoA
GetRawInputDeviceList
SetWindowLongW
MonitorFromRect
RegisterClassW
AttachThreadInput
RegisterRawInputDevices
SystemParametersInfoW
CreateIconIndirect
CopyImage
LoadCursorW
SetCursorPos
ReleaseCapture
SetCapture
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
MessageBoxA
TrackMouseEvent
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageExtraInfo
PostMessageW
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
SetWindowPos
IsIconic
GetKeyState
GetAsyncKeyState
SetTimer
KillTimer
GetSystemMetrics
GetMenu
GetForegroundWindow
GetDC
GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
ClipCursor
FillRect
IsRectEmpty
GetWindowLongW
CallNextHookEx
DestroyIcon
GetRawInputData
RegisterWindowMessageA
GetDoubleClickTime
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
ReleaseDC

advapi32

GetTokenInformation
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegOpenKeyExW
GetSecurityInfo
RegQueryValueExW
RegSetValueExW
OpenProcessToken
GetUserNameW
RegDeleteTreeW
RegCreateKeyW
RegSetValueW
RegCloseKey
RegOpenKeyW
CryptGenRandom

shell32

ord155
SHGetKnownFolderPath
SHChangeNotify
ShellExecuteW
SHCreateItemFromParsingName
SHGetFolderPathW
ExtractIconExW
DragFinish
DragQueryFileW
SHOpenFolderAndSelectItems
DragAcceptFiles
ord190

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
PropVariantClear
CoInitializeEx
CoInitialize
CoUninitialize

wininet

InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetQueryDataAvailable
InternetSetOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW

imm32

ImmSetCompositionWindow
ImmNotifyIME
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
ImmSetCandidateWindow

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
timeBeginPeriod
timeEndPeriod
waveOutGetNumDevs
waveOutGetDevCapsW
waveOutGetErrorTextW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiEnumDeviceInfo

bcrypt

BCryptExportKey
BCryptGetProperty
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptImportKeyPair
BCryptVerifySignature
BCryptSignHash
BCryptCreateHash

winhttp

WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpSendRequest

ws2_32

WSACleanup
WSAStartup
setsockopt
getsockopt
WSAIoctl
ntohs
htons
recvfrom
sendto
inet_ntop
recv
send
shutdown
select
connect
closesocket
getnameinfo
accept
listen
bind
WSAGetLastError
socket
freeaddrinfo
getaddrinfo
ioctlsocket

gdi32

SwapBuffers
DeleteObject
CreateCompatibleDC
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleBitmap
CreateDCW
GetDeviceCaps
GetDIBits
CreateBitmap
GetICMProfileW
GetDeviceGammaRamp
SetDeviceGammaRamp
CombineRgn
CreateRectRgn
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
BitBlt
CreateFontIndirectW
GetTextExtentPoint32A
GetTextMetricsW
CreateSolidBrush

oleaut32

SysFreeString

Sections

.text
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15.6MB - Virtual size: 62.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b90e7c9a25208f5c1767eee264c0af95

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

wininet

imm32

version

winmm

crypt32

setupapi

bcrypt

winhttp

ws2_32

gdi32

oleaut32

Sections

.text Size: 9.7MB - Virtual size: 9.7MB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 15.6MB - Virtual size: 62.4MB

.rsrc Size: 77KB - Virtual size: 77KB

.reloc Size: 399KB - Virtual size: 398KB

.text
Size: 9.7MB - Virtual size: 9.7MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 15.6MB - Virtual size: 62.4MB

.rsrc
Size: 77KB - Virtual size: 77KB

.reloc
Size: 399KB - Virtual size: 398KB