D:\jenkins\workspace\Morpho_Win_Bundle_Release\src_build\bin\RelWithDebInfo\Amazon Music Helper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-29_65904dc659ccd8ba141c51dc16654722_magniber_revil.exe
Resource
win7-20240221-en
General
-
Target
2024-03-29_65904dc659ccd8ba141c51dc16654722_magniber_revil
-
Size
4.3MB
-
MD5
65904dc659ccd8ba141c51dc16654722
-
SHA1
9903033007d86a3b024cd69e46e3e51d9ad29465
-
SHA256
d5334c927c1fdf16e046b9c9994657d120bd390fbb91d48707301d79a1e80367
-
SHA512
867c3da644e734e9a069d0851b5e1d2eab47097f1dc2ad65d3f580f8dc92b46b7e5a0531c45cf1a83b87fa44f756ea66bed43cedc53dd89748f480fe4e09fcfd
-
SSDEEP
98304:uM3yaVenS5CgOMvBH5vxjWdXyWbBRJsv6tWKFdu9CuMAUdphsrAD527BWG:UNyWzJsv6tWKFdu9CuMvvhsrAVQBWG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-03-29_65904dc659ccd8ba141c51dc16654722_magniber_revil
Files
-
2024-03-29_65904dc659ccd8ba141c51dc16654722_magniber_revil.exe windows:6 windows x86 arch:x86
73dbcdcff976e9846e453ec5ecf9adff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateWaitableTimerW
WideCharToMultiByte
CreateSemaphoreA
OpenEventA
WaitForMultipleObjectsEx
ReleaseSemaphore
ResetEvent
FileTimeToLocalFileTime
WaitNamedPipeW
CreateEventW
CreateMutexW
ReleaseMutex
HeapFree
HeapAlloc
GetProcessHeap
WaitForSingleObjectEx
GetSystemTimeAsFileTime
MultiByteToWideChar
GetCurrentProcessId
WaitForMultipleObjects
TlsSetValue
TlsGetValue
TerminateThread
QueueUserAPC
SetWaitableTimer
WaitForSingleObject
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
VerSetConditionMask
SetEvent
CloseHandle
CreateEventA
GetVersionExW
TlsFree
TlsAlloc
GetCurrentThreadId
SleepEx
DeleteCriticalSection
VerifyVersionInfoW
Sleep
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CompareStringW
GetUserDefaultLCID
GetCommandLineW
OutputDebugStringW
GetStartupInfoW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetSystemTime
GetLocaleInfoW
LocalFree
FormatMessageW
DuplicateHandle
GetCurrentProcess
SwitchToThread
CreateThread
GetCurrentThread
SetThreadPriority
GetThreadPriority
ResumeThread
GetSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
CreateFileW
ReadFile
SetFilePointer
WriteFile
PostQueuedCompletionStatus
PeekNamedPipe
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
RemoveDirectoryW
GetTempPathW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFileType
SetEndOfFile
SetFilePointerEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryW
LoadLibraryW
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultUILanguage
FreeLibrary
LoadLibraryExW
GetOverlappedResult
FindFirstFileExW
FindNextFileW
LoadLibraryA
GlobalMemoryStatus
FlushConsoleInputBuffer
SystemTimeToFileTime
IsDebuggerPresent
GetVolumeInformationW
GlobalMemoryStatusEx
GetNativeSystemInfo
GlobalAlloc
GlobalFree
LocalAlloc
lstrlenW
GetComputerNameW
OpenMutexW
ConnectNamedPipe
DisconnectNamedPipe
CreateNamedPipeW
GetStringTypeW
EncodePointer
DecodePointer
FormatMessageA
LCMapStringW
LCMapStringA
GetStringTypeExA
GetModuleHandleA
CreateWaitableTimerA
SetConsoleCtrlHandler
RaiseException
RtlUnwind
ExitThread
HeapReAlloc
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetTimeZoneInformation
IsProcessorFeaturePresent
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFileAttributesW
SetStdHandle
ReadConsoleInputA
SetConsoleMode
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsValidLocale
EnumSystemLocalesW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
SetEnvironmentVariableA
SetEnvironmentVariableW
WriteConsoleW
GetDriveTypeW
GetFileTime
MoveFileExW
GetLastError
ws2_32
closesocket
WSACleanup
WSAStartup
recv
gethostname
send
WSAAsyncSelect
WSAAddressToStringW
shutdown
ntohs
ntohl
htons
freeaddrinfo
getaddrinfo
WSASocketW
WSARecv
WSAIoctl
select
listen
htonl
getsockopt
getsockname
connect
bind
accept
__WSAFDIsSet
WSAStringToAddressW
WSASend
WSAGetLastError
WSASetLastError
setsockopt
ioctlsocket
mswsock
GetAcceptExSockaddrs
AcceptEx
user32
SetTimer
KillTimer
GetWindowLongW
SetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
PostThreadMessageW
EnumWindows
DestroyWindow
GetProcessWindowStation
GetUserObjectInformationW
MsgWaitForMultipleObjectsEx
LoadStringA
CharNextExA
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
PostMessageW
MessageBoxW
GetQueueStatus
PeekMessageW
DispatchMessageW
GetWindowThreadProcessId
TranslateMessage
ole32
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
SysStringLen
advapi32
RegFlushKey
ConvertSidToStringSidW
RegQueryValueExA
OpenProcessToken
CopySid
FreeSid
GetLengthSid
GetTokenInformation
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
LookupAccountNameW
GetUserNameW
RegOpenKeyExA
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 467KB - Virtual size: 467KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 676KB - Virtual size: 680KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE