2024-03-14_9b706324833a7a207030f460026e1c83_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-14_9b706324833a7a207030f460026e1c83_magniber
Size

6.7MB
MD5

9b706324833a7a207030f460026e1c83
SHA1

408784e7389def51b9c604a9d0b0e749b32f9d61
SHA256

97f728b00022df54ae3b060e73ba6083dac9772233e42ff4cea11ed86a6e6a32
SHA512

d9b9e6a0a1ea2b833c79e7de1fd5a32a48019a7cef7b65ad4a03c797ef7a37ccef84962bc6523493d72775fd92ecf22fbb904f3dfeaf564c62b8133f498c56da
SSDEEP

196608:uPiqzdUQJDV22QVkVmzOHPNbXJ8Qlq2FE:uPzdUQJDVzPNbzK

Score

1^/10

Malware Config

Signatures

Files

2024-03-14_9b706324833a7a207030f460026e1c83_magniber
.exe windows:6 windows x86 arch:x86

265f6df021f22aa102f403ec7315ea27

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/06/2023, 00:00

Not After

20/06/2024, 23:59

Subject

SERIALNUMBER=202237692H,CN=SINGHEAR PTE.LTD.,O=SINGHEAR PTE.LTD.,L=SINGAPORE,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/06/2023, 00:00

Not After

20/06/2024, 23:59

Subject

SERIALNUMBER=202237692H,CN=SINGHEAR PTE.LTD.,O=SINGHEAR PTE.LTD.,L=SINGAPORE,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:d0:24:8e:4b:5c:eb:75:4d:84:9f:63:03:2a:ce:f9:a6:a3:c7:1f:b3:a6:1b:ab:e2:c0:fb:2a:c3:0d:00:51
Signer

Actual PE Digest

d8:d0:24:8e:4b:5c:eb:75:4d:84:9f:63:03:2a:ce:f9:a6:a3:c7:1f:b3:a6:1b:ab:e2:c0:fb:2a:c3:0d:00:51

Digest Algorithm

sha256

PE Digest Matches

true

19:72:7e:30:b4:18:70:03:0b:ba:7f:4c:ec:01:2f:fb:1e:a3:36:b2
Signer

Actual PE Digest

19:72:7e:30:b4:18:70:03:0b:ba:7f:4c:ec:01:2f:fb:1e:a3:36:b2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins_win\workspace\cpp-sgtools\SG-Tools\src\SGTools\bin\Release\MyBuff.pdb

Imports

ws2_32

gethostname
shutdown
socket
send
getsockopt
getpeername
ioctlsocket
__WSAFDIsSet
getsockname
WSAIoctl
getnameinfo
closesocket
bind
select
WSASocketW
WSAGetLastError
WSACleanup
WSAStartup
sendto
recvfrom
inet_addr
connect
accept
freeaddrinfo
getaddrinfo
WSAAddressToStringW
WSASend
WSARecv
WSASetLastError
setsockopt
ntohs
ntohl
htonl
htons
listen
recv

iphlpapi

GetAdaptersInfo

shlwapi

PathRemoveFileSpecA
PathFindFileNameW
PathAddBackslashW
SHStrDupW
PathRemoveFileSpecW
PathAddBackslashA
StrCatW
StrCpyW

wldap32

ord30
ord79
ord35
ord301
ord33
ord32
ord200
ord143
ord217
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext

imm32

ImmAssociateContextEx
ImmNotifyIME
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW

opengl32

glPushAttrib
glOrtho
glTexSubImage2D
glPixelStorei
glPushMatrix
glDisable
glColor4f
glRotatef
glVertex2f
wglCreateContext
wglDeleteContext
wglMakeCurrent
glPopMatrix
glViewport
glInterleavedArrays
glClear
glTexImage2D
glDrawArrays
glVertex2i
glClearColor
glBegin
glHint
glDeleteTextures
glTexParameteri
glLoadIdentity
glBlendFunc
glColor3f
glLineWidth
glMatrixMode
glEnd
glEnable
glGenTextures
glBindTexture
glTexEnvf
glPopAttrib

d3d11

D3D11CreateDevice

ntdll

NtResumeProcess
NtSuspendProcess
VerSetConditionMask
RtlUnwind

kernel32

GetExitCodeThread
DuplicateHandle
GetStringTypeW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
GetStartupInfoW
ReleaseSemaphore
OpenEventA
CloseHandle
GetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentThreadId
WaitForMultipleObjects
VirtualAlloc
VirtualFree
GetSystemTimes
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
GetLocalTime
GetTickCount
FreeLibrary
GetProcAddress
WinExec
LoadLibraryA
SystemTimeToFileTime
CreateFileA
DeleteFileA
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
CreateRemoteThread
OpenProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetCommandLineW
CreateDirectoryW
CreateFileW
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThread
GetModuleFileNameW
LoadLibraryW
WritePrivateProfileStringW
GetFileSize
SetLastError
IsWow64Process
GetModuleHandleW
GetSystemInfo
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
GetSystemDefaultLangID
GetLogicalProcessorInformation
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetFileAttributesA
GetFileAttributesW
GetFullPathNameW
GetLogicalDriveStringsW
QueryDosDeviceW
RemoveDirectoryA
SetFileAttributesA
SetFileAttributesW
CreateEventA
GetExitCodeProcess
CreateProcessW
GetWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameA
GlobalLock
GlobalUnlock
lstrcmpiA
lstrcmpiW
lstrcpyA
lstrcpyW
lstrcatA
lstrcatW
lstrlenW
GetPrivateProfileStringW
IsBadReadPtr
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
Module32NextW
K32GetModuleFileNameExA
K32GetProcessMemoryInfo
K32GetProcessImageFileNameW
GlobalMemoryStatusEx
HeapDestroy
HeapReAlloc
HeapSize
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetFileTime
LocalFileTimeToFileTime
EncodePointer
DosDateTimeToFileTime
TlsAlloc
TlsFree
GetFinalPathNameByHandleA
ConnectNamedPipe
CreateNamedPipeW
ResetEvent
LocalAlloc
LocalFree
CopyFileW
LoadLibraryExA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetEnvironmentVariableW
SetEnvironmentVariableW
MoveFileW
FlushFileBuffers
DisconnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeA
WaitNamedPipeA
FreeResource
InitializeCriticalSectionAndSpinCount
ReleaseMutex
SleepEx
CreateMutexW
SetWaitableTimer
QueueUserAPC
TerminateThread
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
CreateWaitableTimerW
VerifyVersionInfoW
SetFilePointer
ResumeThread
CreateProcessA
GetThreadContext
SetThreadContext
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
RaiseException
K32GetModuleFileNameExW
GetEnvironmentVariableA
SetEnvironmentVariableA
SetDllDirectoryW
DecodePointer
InitializeCriticalSectionEx
lstrcpynW
MulDiv
GetCurrentDirectoryW
GlobalAlloc
FileTimeToSystemTime
GetSystemTime
GetStdHandle
OutputDebugStringA
OutputDebugStringW
FormatMessageA
GetUserDefaultLangID
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetPrivateProfileIntW
TryEnterCriticalSection
GetModuleHandleExW
GetTickCount64
GetFileType
SwitchToFiber
DeleteFiber
CreateFiber
FormatMessageW
WaitForSingleObjectEx
ExpandEnvironmentStringsA
PeekNamedPipe
GetSystemDirectoryA
VerifyVersionInfoA
QueryPerformanceCounter
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
QueryPerformanceFrequency
GetThreadTimes
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
GetLocaleInfoW
GetProcessAffinityMask
LCMapStringW
SetThreadAffinityMask
CompareStringW
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
LoadLibraryExW
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetFileAttributesExW
ExitThread
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
GetTimeZoneInformation
ExitProcess
GetFullPathNameA
GetACP
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCPInfo
IsProcessorFeaturePresent
QueueUserWorkItem
SetStdHandle
SetFileTime
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
VirtualQuery
CreateDirectoryA
GetDriveTypeW

user32

GetCapture
SetClassLongW
WindowFromPoint
GetTouchInputInfo
CloseTouchInputHandle
VkKeyScanExW
DestroyCaret
IsRectEmpty
IntersectRect
GetSysColor
MapWindowPoints
ScreenToClient
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetFocus
GetActiveWindow
SetFocus
IsZoomed
DispatchMessageW
TranslateMessage
GetMessageW
MonitorFromPoint
ReleaseDC
LoadCursorW
GetWindowRgn
UpdateLayeredWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
OffsetRect
UnionRect
InflateRect
LoadIconW
EnumDisplayMonitors
RegisterTouchWindow
GetCursorPos
GetClientRect
GetKeyState
GetWindowPlacement
MoveWindow
IsWindow
PostQuitMessage
RegisterWindowMessageW
ShowWindow
IsWindowVisible
EnumWindows
GetWindowLongW
GetAsyncKeyState
MessageBoxExA
MessageBoxA
GetClipboardData
CloseClipboard
OpenClipboard
FindWindowW
MessageBoxExW
EnumDisplaySettingsW
GetIconInfo
GetDesktopWindow
GetDC
CharNextW
ExitWindowsEx
MessageBoxW
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetWindowThreadProcessId
GetParent
GetWindowRect
RedrawWindow
SetForegroundWindow
GetForegroundWindow
GetSystemMetrics
BringWindowToTop
IsIconic
SetWindowPos
AttachThreadInput
PostMessageW
SendMessageW
GetDoubleClickTime
TrackMouseEvent
GetMessageTime
LoadAcceleratorsW
IsDialogMessageW
TranslateAcceleratorW
SetParent
MonitorFromRect
SetWindowPlacement
DeferWindowPos
EnumChildWindows
EndDialog
RemovePropW
BeginDeferWindowPos
SetMenu
EndDeferWindowPos
DialogBoxParamW
UpdateWindow
GetAncestor
GetUserObjectInformationW
GetProcessWindowStation
MapVirtualKeyExW
GetKeyNameTextW
GetKeyboardLayout
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawTextA
wsprintfA
EqualRect
IsWindowEnabled
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SystemParametersInfoW
wsprintfW
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
TrackPopupMenu
AppendMenuW
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetCursor
SetRect
FillRect
DrawTextW
CharPrevW
SetWindowRgn
AdjustWindowRectEx
GetPropW
SetPropW
GetMenu
EnableWindow
GetClassInfoExW
RegisterClassW
CallWindowProcW
SetWindowLongW
PtInRect

gdi32

CreateFontW
SetBitmapBits
GetBitmapBits
FillRgn
SetWindowOrgEx
CreateRoundRectRgn
SetRectRgn
SetPixelFormat
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
SwapBuffers
CreatePatternBrush
ChoosePixelFormat
CreateFontIndirectW
CreateDIBSection
CreateDIBitmap
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SelectObject
PtInRegion
CreatePen
GetStockObject
AddFontMemResourceEx
DeleteDC
SetBkMode
CreateRectRgn
RemoveFontMemResourceEx
Rectangle
RestoreDC
GetTextExtentPointA
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
SetBkColor
CreateCompatibleDC
GetObjectW
DeleteObject

comdlg32

FindTextW
GetOpenFileNameA

advapi32

RegEnumKeyExA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExA
RegCreateKeyA
RegGetValueA
RegCreateKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptAcquireContextW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
OpenProcessToken
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

shell32

SHGetSpecialFolderPathW
ExtractIconExW
ShellExecuteW
ShellExecuteExA
SHGetSpecialFolderPathA
SHGetFolderPathW
SHGetPathFromIDListA
SHGetPathFromIDListW
SHBrowseForFolderA
SHBrowseForFolderW
SHAppBarMessage
Shell_NotifyIconW
DragQueryFileW
DragAcceptFiles
ShellExecuteA

ole32

CoInitializeEx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
ReleaseStgMedium
OleDuplicateData
DoDragDrop
RegisterDragDrop
CoTaskMemFree
PropVariantClear
CoCreateGuid
OleRun
CoUninitialize
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
CoInitialize

oleaut32

VarBstrCat
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SysStringLen
SysFreeString
VariantInit
GetErrorInfo
SysAllocString

comctl32

ord17
_TrackMouseEvent

gdiplus

GdipAlloc
GdipFree
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdiplusStartup
GdiplusShutdown
GdipSetStringFormatAlign
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipTranslateWorldTransform
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipRotateWorldTransform
GdipCreateFontFromDC
GdipCloneBrush
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth

pdh

PdhOpenQueryW
PdhAddCounterW
PdhRemoveCounter
PdhCollectQueryData
PdhCloseQuery

wlanapi

WlanCloseHandle
WlanEnumInterfaces
WlanFreeMemory
WlanOpenHandle

mswsock

GetAcceptExSockaddrs
AcceptEx

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

bcrypt

BCryptGenRandom

winhttp

WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpOpen
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpCrackUrl

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 115KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 602KB - Virtual size: 602KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

265f6df021f22aa102f403ec7315ea27

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:edCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:edCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d8:d0:24:8e:4b:5c:eb:75:4d:84:9f:63:03:2a:ce:f9:a6:a3:c7:1f:b3:a6:1b:ab:e2:c0:fb:2a:c3:0d:00:51Signer

19:72:7e:30:b4:18:70:03:0b:ba:7f:4c:ec:01:2f:fb:1e:a3:36:b2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

iphlpapi

shlwapi

wldap32

crypt32

imm32

opengl32

d3d11

ntdll

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

pdh

wlanapi

mswsock

version

bcrypt

winhttp

Sections

.text Size: 4.8MB - Virtual size: 4.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 115KB - Virtual size: 147KB

.gfids Size: 3KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 602KB - Virtual size: 602KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0e:6b:c7:a9:46:49:bc:64:d8:79:c5:47:a2:63:64:ed
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d8:d0:24:8e:4b:5c:eb:75:4d:84:9f:63:03:2a:ce:f9:a6:a3:c7:1f:b3:a6:1b:ab:e2:c0:fb:2a:c3:0d:00:51
Signer

19:72:7e:30:b4:18:70:03:0b:ba:7f:4c:ec:01:2f:fb:1e:a3:36:b2
Signer

.text
Size: 4.8MB - Virtual size: 4.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 115KB - Virtual size: 147KB

.gfids
Size: 3KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 602KB - Virtual size: 602KB