2024-03-14_94373fe66d6d6a0edaf0bf40486fa0a9_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-14_94373fe66d6d6a0edaf0bf40486fa0a9_magniber
Size

29.1MB
MD5

94373fe66d6d6a0edaf0bf40486fa0a9
SHA1

9af2e8f477b92f12a8e18d68436a29a84e66273f
SHA256

c89bae493d9210738362ffd318be7247c7b2809f3c2cb76fc53f6c2779d72ddd
SHA512

1560b84659b1306644d8eeab9b4a33460a94ebaa96fcaf3aabcb4f6576a75066c22affd6049a737b865ce206775e31e1be25a6c5fde9f66642c66abdc2ca2e88
SSDEEP

196608:gkdcKKddWyPyNKjt/aTodalkqSZ/Sla9kotPrePy30r:gU7odLqKSVoEPy3W

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-03-14_94373fe66d6d6a0edaf0bf40486fa0a9_magniber

Files

2024-03-14_94373fe66d6d6a0edaf0bf40486fa0a9_magniber
.exe windows:6 windows x86 arch:x86

b90e7c9a25208f5c1767eee264c0af95

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\OpenRCT2\OpenRCT2\bin\openrct2-win.pdb

Imports

kernel32

GetSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
QueryPerformanceFrequency
FormatMessageW
lstrcmpiW
GetLastError
LCMapStringEx
MultiByteToWideChar
QueryPerformanceCounter
ReadDirectoryChangesW
CancelIoEx
FindClose
FindNextFileW
SetConsoleMode
CopyFileW
FindFirstFileW
ReadConsoleInputW
SetConsoleTitleW
GetConsoleTitleW
ScrollConsoleScreenBufferW
SetConsoleCursorPosition
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleCursorInfo
GetConsoleCursorInfo
WriteConsoleInputW
WriteConsoleW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
GetLogicalDrives
GetEnvironmentVariableW
GetDateFormatEx
GetTimeFormatEx
GetModuleHandleW
GetProcAddress
GetStdHandle
GetConsoleMode
HeapFree
GetProcessHeap
lstrcmpW
HeapAlloc
GetCurrentProcess
GetLocaleInfoEx
GetFileAttributesExW
CloseHandle
GetFileTime
CreateFileW
GetModuleFileNameW
FileTimeToSystemTime
HeapSize
SetEndOfFile
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
WideCharToMultiByte
SetConsoleOutputCP
SetConsoleCP
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleOutputCP
FreeLibraryAndExitThread
ExitThread
TlsFree
SetLastError
InterlockedPushEntrySList
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
InitializeSListHead
GetCPInfo
GetStringTypeW
InitializeCriticalSectionEx
DecodePointer
EncodePointer
AcquireSRWLockShared
ReleaseSRWLockShared
GetNativeSystemInfo
GetExitCodeThread
GetFileInformationByHandleEx
AreFileApisANSI
SetFileInformationByHandle
GetFullPathNameW
GetFinalPathNameByHandleW
GetFileInformationByHandle
FindFirstFileExW
InitOnceComplete
InitOnceBeginInitialize
IsProcessorFeaturePresent
lstrlenW
ReadFile
WriteFile
PeekNamedPipe
WaitNamedPipeW
GetCurrentProcessId
GetFileType
FreeLibrary
LoadLibraryW
CreateFileA
GetFileSizeEx
HeapReAlloc
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
LoadLibraryA
OutputDebugStringW
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
MulDiv
SetThreadExecutionState
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
Sleep
VerSetConditionMask
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
LocalFree
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
GetModuleHandleExW
GetSystemPowerStatus
GetLocaleInfoA
MoveFileExW
DeleteFileW
SetFileAttributesW
GetFileAttributesW
RtlCaptureContext
SetUnhandledExceptionFilter
InitializeCriticalSection
GetProcessId
VirtualQueryEx
SetNamedPipeHandleState
TransactNamedPipe
SetEvent
WaitForMultipleObjects
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
VirtualQuery

user32

GetRawInputDeviceInfoA
GetDesktopWindow
SetWindowRgn
MonitorFromWindow
PostThreadMessageW
CreateIconFromResource
UnhookWindowsHookEx
SetWindowsHookExW
GetWindowThreadProcessId
GetParent
DialogBoxIndirectParamW
PtInRect
IntersectRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RemovePropW
SetPropW
SetForegroundWindow
SetActiveWindow
GetFocus
SetFocus
FlashWindowEx
SetLayeredWindowAttributes
ShowWindow
CreateWindowExW
EndDialog
SendMessageW
LoadIconW
MessageBoxW
GetDlgItem
DrawTextW
SystemParametersInfoA
GetRawInputDeviceList
SetWindowLongW
MonitorFromRect
RegisterClassW
AttachThreadInput
RegisterRawInputDevices
SystemParametersInfoW
CreateIconIndirect
CopyImage
LoadCursorW
SetCursorPos
ReleaseCapture
SetCapture
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW
MessageBoxA
TrackMouseEvent
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageExtraInfo
PostMessageW
DefWindowProcW
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
SetWindowPos
IsIconic
GetKeyState
GetAsyncKeyState
SetTimer
KillTimer
GetSystemMetrics
GetMenu
GetForegroundWindow
GetDC
GetUpdateRect
InvalidateRect
ValidateRect
GetPropW
GetClientRect
GetWindowRect
AdjustWindowRectEx
SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
ClipCursor
FillRect
IsRectEmpty
GetWindowLongW
CallNextHookEx
DestroyIcon
GetRawInputData
RegisterWindowMessageA
GetDoubleClickTime
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
ReleaseDC

advapi32

GetTokenInformation
CryptReleaseContext
CryptAcquireContextA
RegCreateKeyExW
RegOpenKeyExW
GetSecurityInfo
RegQueryValueExW
RegSetValueExW
OpenProcessToken
GetUserNameW
RegDeleteTreeW
RegCreateKeyW
RegSetValueW
RegCloseKey
RegOpenKeyW
CryptGenRandom

shell32

ord155
SHGetKnownFolderPath
SHChangeNotify
ShellExecuteW
SHCreateItemFromParsingName
SHGetFolderPathW
ExtractIconExW
DragFinish
DragQueryFileW
SHOpenFolderAndSelectItems
DragAcceptFiles
ord190

ole32

CoCreateInstance
CoTaskMemFree
CLSIDFromString
PropVariantClear
CoInitializeEx
CoInitialize
CoUninitialize

wininet

InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetQueryDataAvailable
InternetSetOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW

imm32

ImmSetCompositionWindow
ImmNotifyIME
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
ImmSetCandidateWindow

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

waveInReset
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveInOpen
waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutClose
waveOutOpen
timeBeginPeriod
timeEndPeriod
waveOutGetNumDevs
waveOutGetDevCapsW
waveOutGetErrorTextW

crypt32

CryptStringToBinaryA
CryptBinaryToStringA

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiEnumDeviceInfo

bcrypt

BCryptExportKey
BCryptGetProperty
BCryptDestroyHash
BCryptHashData
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptDestroyKey
BCryptCloseAlgorithmProvider
BCryptGenerateKeyPair
BCryptFinalizeKeyPair
BCryptImportKeyPair
BCryptVerifySignature
BCryptSignHash
BCryptCreateHash

winhttp

WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpSendRequest

ws2_32

WSACleanup
WSAStartup
setsockopt
getsockopt
WSAIoctl
ntohs
htons
recvfrom
sendto
inet_ntop
recv
send
shutdown
select
connect
closesocket
getnameinfo
accept
listen
bind
WSAGetLastError
socket
freeaddrinfo
getaddrinfo
ioctlsocket

gdi32

SwapBuffers
DeleteObject
CreateCompatibleDC
DeleteDC
SelectObject
CreateDIBSection
CreateCompatibleBitmap
CreateDCW
GetDeviceCaps
GetDIBits
CreateBitmap
GetICMProfileW
GetDeviceGammaRamp
SetDeviceGammaRamp
CombineRgn
CreateRectRgn
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
BitBlt
CreateFontIndirectW
GetTextExtentPoint32A
GetTextMetricsW
CreateSolidBrush

oleaut32

SysFreeString

Sections

.text
Size: 9.7MB - Virtual size: 9.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15.6MB - Virtual size: 62.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 399KB - Virtual size: 398KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b90e7c9a25208f5c1767eee264c0af95

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

wininet

imm32

version

winmm

crypt32

setupapi

bcrypt

winhttp

ws2_32

gdi32

oleaut32

Sections

.text Size: 9.7MB - Virtual size: 9.7MB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 15.6MB - Virtual size: 62.4MB

.rsrc Size: 77KB - Virtual size: 77KB

.reloc Size: 399KB - Virtual size: 398KB

.text
Size: 9.7MB - Virtual size: 9.7MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 15.6MB - Virtual size: 62.4MB

.rsrc
Size: 77KB - Virtual size: 77KB

.reloc
Size: 399KB - Virtual size: 398KB