2024-03-25_4416257310f1d28b5530e486bf3b0bdf_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-03-25_4416257310f1d28b5530e486bf3b0bdf_magniber
Size

3.1MB
MD5

4416257310f1d28b5530e486bf3b0bdf
SHA1

c273dc61fce4d58b6c7d499c7fa89886b3e70129
SHA256

2ba560d530a4c7879ade9c79a45fed901abe995a1e762db7370007a03ae1b643
SHA512

2b0745e13af51ede4da9879cde033e073b680a60fdf8e3808c7a7105ee5f1ea99fb4bbd89e53ae98805e4f9ca15d7e9e9526e6ee639168fac0268f2493a0ffa3
SSDEEP

49152:ds420lyBdv61I9lAPtDh5gZoaaMFDGEMeMHnauNaSz7FeTI1clv/guhkG2QrjakB:dNh5geMVGVauNaSRclvJIojv

Score

1^/10

Malware Config

Signatures

Files

2024-03-25_4416257310f1d28b5530e486bf3b0bdf_magniber
.exe windows:5 windows x86 arch:x86

a17ef6efa6f01b6945589d1ed4719501

Code Sign

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:70:c6:3e:48:1b:ec:f9:93:65:71:07:2d:de:78:c2
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

28/10/2021, 19:16

Not After

28/10/2022, 19:16

Subject

CN=Keen Internet Technologies Ltd,O=Keen Internet Technologies Ltd,L=Herzliya,ST=Tel Aviv District,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bb:e0:1f:3b:a2:41:27:4e:d6:58:4c:d5:74:38:0c:02:67:39:73:27
Signer

Actual PE Digest

bb:e0:1f:3b:a2:41:27:4e:d6:58:4c:d5:74:38:0c:02:67:39:73:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\projects\FreeVPN\FreeVPN\Release\FreeVPN.pdb

Imports

libcurl

curl_formfree
curl_slist_free_all
curl_formadd
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_easy_init
curl_easy_strerror

libeay32

ord2996
ord3783
ord501
ord251
ord2894
ord2660
ord276
ord3782

rasapi32

RasGetConnectStatusA
RasDeleteEntryA
RasSetCredentialsA
RasSetEntryPropertiesA
RasEnumConnectionsA
RasValidateEntryNameA
RasGetConnectionStatistics
RasDialA
RasHangUpA

kernel32

SetFileTime
CloseHandle
SystemTimeToFileTime
LocalFileTimeToFileTime
GetCurrentDirectoryA
CreateDirectoryA
CreateFileA
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentThreadId
SetLastError
SetEvent
MulDiv
lstrcmpA
FreeLibrary
GetProcAddress
GlobalHandle
GlobalFree
OpenProcess
GetCurrentProcess
WaitForSingleObject
GetTickCount
FormatMessageA
CreatePipe
lstrcmpW
lstrcmpiA
CreateMutexA
CreateEventA
LoadLibraryExA
GetModuleHandleA
CreateProcessA
GetCommandLineW
FindResourceA
GetSystemDirectoryA
IsDBCSLeadByte
GetLocaleInfoW
GetUserDefaultUILanguage
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
TerminateThread
GetSystemTimeAsFileTime
TerminateProcess
SetCurrentDirectoryA
GetCurrentProcessId
lstrcpyA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
MoveFileExW
RemoveDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetFullPathNameA
GetFullPathNameW
GetDriveTypeW
WideCharToMultiByte
SetFilePointer
ResumeThread
ExitThread
GetModuleHandleExW
ExitProcess
VirtualQuery
GetSystemInfo
RtlUnwind
LoadLibraryW
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
SetProcessAffinityMask
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
WriteFile
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
AreFileApisANSI
CreateHardLinkW
CopyFileW
GetTempPathW
SetFilePointerEx
SetFileAttributesW
SetEndOfFile
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileExW
FindClose
CreateFileW
CreateDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
TryEnterCriticalSection
GetNativeSystemInfo
GetExitCodeThread
GetCurrentThread
WaitForSingleObjectEx
DuplicateHandle
GetTimeZoneInformation
ReadFile
GetVersion
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
GetVersionExA
GetFileAttributesA
Sleep
MultiByteToWideChar
FormatMessageW
LocalFree
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
DeleteFileW
GetStdHandle
RtlCaptureStackBackTrace
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetExitCodeProcess
SetConsoleCtrlHandler
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringA
SetStdHandle
LeaveCriticalSection
EnterCriticalSection
GetThreadTimes
InitializeCriticalSection
WriteConsoleW
CreateProcessW

user32

AppendMenuA
CreatePopupMenu
AllowSetForegroundWindow
SetWindowRgn
SetWindowContextHelpId
GetWindowThreadProcessId
MapDialogRect
PostMessageA
UnregisterClassA
FindWindowA
GetForegroundWindow
RegisterWindowMessageA
DrawAnimatedRects
DefWindowProcA
RegisterClassExA
CreateWindowExA
CreateMenu
GetAsyncKeyState
IsWindow
DestroyWindow
SetTimer
KillTimer
LoadMenuA
DestroyMenu
GetSubMenu
GetMenuItemID
TrackPopupMenu
SetMenuDefaultItem
SetActiveWindow
SetForegroundWindow
RedrawWindow
GetWindowRect
GetCursorPos
GetWindowLongA
SetWindowLongA
SetParent
EnumChildWindows
GetClassNameA
LoadIconA
DestroyIcon
LoadImageA
GetActiveWindow
SendDlgItemMessageA
EndDialog
DialogBoxIndirectParamA
DialogBoxParamA
CreateDialogIndirectParamA
BringWindowToTop
PostQuitMessage
AttachThreadInput
DispatchMessageA
TranslateMessage
GetMessageA
LoadStringA
GetWindow
GetParent
GetDesktopWindow
SetRect
FillRect
GetSysColor
ScreenToClient
ClientToScreen
MessageBoxA
GetClientRect
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableA
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextA
GetDlgItem
SetWindowPos
MoveWindow
ShowWindow
IsChild
GetClassInfoExA
CallWindowProcA
PostThreadMessageA
SendMessageA
wsprintfA
SystemParametersInfoA
LoadCursorA

advapi32

ControlService
CryptGenRandom
CryptAcquireContextW
OpenProcessToken
RegDeleteKeyExA
RegQueryInfoKeyA
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerExA
QueryServiceStatusEx
OpenServiceA
OpenSCManagerA
EnumDependentServicesA
DeleteService
CreateServiceA
CloseServiceHandle
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyW
RegOpenKeyExA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
DuplicateTokenEx
CreateProcessAsUserA
ImpersonateLoggedOnUser
LookupAccountSidA
GetTokenInformation
RevertToSelf

ole32

CoInitializeEx
CoTaskMemAlloc
CoGetClassObject
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoTaskMemRealloc
CoInitializeSecurity
StringFromGUID2
CoUninitialize
CreateStreamOnHGlobal
OleLockRunning
OleSetContainedObject
OleCreate
OleUninitialize
OleInitialize
CoTaskMemFree

shell32

SHAppBarMessage
Shell_NotifyIconA
ShellExecuteA
CommandLineToArgvW
ShellExecuteExA
SHGetSpecialFolderPathA

oleaut32

VarUI4FromStr
OleCreateFontIndirect
GetErrorInfo
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
DispCallFunc
VariantChangeType
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen

comctl32

InitCommonControlsEx

gdi32

BitBlt
CreateCompatibleDC
CreateSolidBrush
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
SelectObject
GetObjectA
CreateRoundRectRgn
TextOutA
CreateCompatibleBitmap

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA
GetModuleFileNameExA

version

GetFileVersionInfoSizeW
GetFileVersionInfoW

urlmon

URLDownloadToFileA

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile
LoadUserProfileA

iphlpapi

GetAdaptersAddresses

ws2_32

htons
connect
select
WSAStartup
WSAAddressToStringA
send
recv
WSAGetLastError
__WSAFDIsSet
closesocket
inet_addr
socket

fwpuclnt

FwpmTransactionCommit0
FwpmSubLayerAdd0
FwpmSubLayerGetByKey0
FwpmEngineOpen0
FwpmTransactionBegin0
FwpmFilterDeleteByKey0
FwpmFreeMemory0
FwpmFilterAdd0
FwpmEngineClose0

Exports

Exports

CmdProc
FinalizeOVSCore
InitOVSCore

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a17ef6efa6f01b6945589d1ed4719501

Code Sign

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

3a:70:c6:3e:48:1b:ec:f9:93:65:71:07:2d:de:78:c2Certificate

Extended Key Usages

Key Usages

bb:e0:1f:3b:a2:41:27:4e:d6:58:4c:d5:74:38:0c:02:67:39:73:27Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcurl

libeay32

rasapi32

kernel32

user32

advapi32

ole32

shell32

oleaut32

comctl32

gdi32

psapi

version

urlmon

userenv

iphlpapi

ws2_32

fwpuclnt

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 230KB - Virtual size: 230KB

.data Size: 21KB - Virtual size: 30KB

.gfids Size: 5KB - Virtual size: 5KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 1.6MB - Virtual size: 1.6MB

.reloc Size: 59KB - Virtual size: 58KB

64:33:51:d3:c7:38:9f:08
Certificate

3a:70:c6:3e:48:1b:ec:f9:93:65:71:07:2d:de:78:c2
Certificate

bb:e0:1f:3b:a2:41:27:4e:d6:58:4c:d5:74:38:0c:02:67:39:73:27
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 230KB - Virtual size: 230KB

.data
Size: 21KB - Virtual size: 30KB

.gfids
Size: 5KB - Virtual size: 5KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 59KB - Virtual size: 58KB