2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil
Size 4.3MB
Sample240403-t4pfvafe51
SHA256 2f3de0083f08a08847552ce3add2e72cd33a9b45ad52b95037e08d40532a1704
MD5 71dc862476a59f9b0672be0421e1d909
SHA1 54796e4c6433443eb1d6b2035fe06e39cefcd756
SHA512 751cebf592d2b465ea6d3e1a2a389eff35e62566faf0447048f3c1992573219b3c25a054eedcc0dbf5095e69dd1d9310a2378456709e05dfd260f27cc3d39fa1
SSDEEP 49152:A5PigeXnpHE21zKhYOPCP1/j2T37gZKUxT2cHF6c9OtutJDmg27RnWGj:AUpH11+hDPS/j4gDx2yD527BWG
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil

File Explorer

2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil

.exe 4.3MB

2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil

IMPHASH 0cc64d938b1dd8acbfc68cbd56373afa
SHA256 2f3de0083f08a08847552ce3add2e72cd33a9b45ad52b95037e08d40532a1704
MD5 71dc862476a59f9b0672be0421e1d909
SHA1 54796e4c6433443eb1d6b2035fe06e39cefcd756
SHA512 751cebf592d2b465ea6d3e1a2a389eff35e62566faf0447048f3c1992573219b3c25a054eedcc0dbf5095e69dd1d9310a2378456709e05dfd260f27cc3d39fa1
SSDEEP 49152:A5PigeXnpHE21zKhYOPCP1/j2T37gZKUxT2cHF6c9OtutJDmg27RnWGj:AUpH11+hDPS/j4gDx2yD527BWG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1524502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\N_MB5Uns\bin\Win32\Release\mb5uns.pdb

crypt32

CryptMsgClose CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CertGetCertificateContextProperty CertDuplicateCertificateContext CryptQueryObject

iphlpapi

GetAdaptersInfo

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW LeaveCriticalSection RaiseException EnterCriticalSection GetCurrentThreadId SetLastError DeleteCriticalSection GetLastError InitializeCriticalSectionEx LocalFree FormatMessageW LocalAlloc Sleep CallNamedPipeW FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW SetCurrentDirectoryW CreateMutexW DecodePointer WideCharToMultiByte GlobalAlloc GlobalLock GlobalFree LoadLibraryW VerifyVersionInfoW VerSetConditionMask SetThreadUILanguage GetSystemDirectoryW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW CloseHandle OpenProcess K32GetModuleFileNameExA WaitForSingleObject GetExitCodeProcess GetModuleFileNameA GetTickCount OutputDebugStringW CreateFileW SwitchToThread GetTempPathW CopyFileW FlushFileBuffers GetFileSizeEx ReadFile WriteFile GetFileInformationByHandle GetCurrentProcess GetSystemInfo GetCurrentThread FileTimeToSystemTime FindFirstFileW GetFileAttributesW CreateDirectoryW HeapReAlloc GetLocalTime GetSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation HeapAlloc SetEndOfFile FindNextFileW FindClose GetModuleHandleA GetStdHandle GetCurrentDirectoryW GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount TerminateProcess GetStartupInfoW SetEvent ResetEvent CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetEnvironmentVariableW SetEnvironmentVariableW SystemTimeToFileTime DeleteFiber GetFileType QueryPerformanceCounter ConvertFiberToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize GetOEMCP GetACP IsValidCodePage SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx SetConsoleCtrlHandler ExitProcess PeekNamedPipe GetDriveTypeW GetModuleHandleExW GetCommandLineW GetCommandLineA RtlUnwind GetThreadTimes HeapDestroy MulDiv GetProcessHeap HeapFree SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer AreFileApisANSI GetFullPathNameW FindFirstFileExW GetStringTypeW LoadLibraryExA VirtualQuery VirtualProtect

dwmapi

DwmGetWindowAttribute

bcrypt

BCryptGenRandom

ws2_32

WSAGetLastError send recv WSASetLastError closesocket WSAStartup WSACleanup

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-03_71dc862476a59f9b0672be0421e1d909_magniber_revil

crypt32

iphlpapi

kernel32

dwmapi

bcrypt

ws2_32

generic