Static task
static1
Behavioral task
behavioral1
Sample
2024-04-05_4ffde214718a13f43f3c3f6145affb31_magniber_revil.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2024-04-05_4ffde214718a13f43f3c3f6145affb31_magniber_revil.exe
Resource
win10v2004-20240319-en
General
-
Target
2024-04-05_4ffde214718a13f43f3c3f6145affb31_magniber_revil
-
Size
5.7MB
-
MD5
4ffde214718a13f43f3c3f6145affb31
-
SHA1
93768bc2b0a7d3ceaf59adcaf67bbb7becd31068
-
SHA256
10319bfdfcf1ada18cb95aeb0d90d142fb023dbdd492ff15c87591678ff3f901
-
SHA512
2858ba717a0d4a0313754650286a3a8fd2acd66bff3f878d2309da1a638b0dbaefc8582aeda92e111dce8321be050e634a0935571b8cd32ca5a29ccc22bd10c0
-
SSDEEP
98304:2pHLE2ZzvfYXkpj+LGXpZevNpuEOZu3qOFs9f6Mby2a905tq7NJ3vY9zzJ:upz+LrvbOZu3pFs1y2a9YafY9zV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-04-05_4ffde214718a13f43f3c3f6145affb31_magniber_revil
Files
-
2024-04-05_4ffde214718a13f43f3c3f6145affb31_magniber_revil.exe windows:6 windows x86 arch:x86
c2d82d65aa3834d85750a682a44879c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wldap32
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord167
ord79
ord46
ord219
ord133
ord147
ord301
ord142
ord145
kernel32
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
ResetEvent
GetUserDefaultLCID
SearchPathW
GetProfileIntW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SwitchToThread
SignalObjectAndWait
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
WriteConsoleW
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetFilePointerEx
GetDriveTypeW
SetStdHandle
QueryPerformanceFrequency
VirtualAlloc
GetCommandLineW
GetCommandLineA
GetTempFileNameW
SetConsoleCtrlHandler
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
DosDateTimeToFileTime
GetLocalTime
ExitProcess
GetACP
CreateMutexW
GetVersionExA
SetEnvironmentVariableA
FormatMessageA
CreateWaitableTimerA
GetLogicalProcessorInformation
OpenEventA
GetSystemTime
GlobalMemoryStatus
FlushConsoleInputBuffer
GetCPInfo
LCMapStringW
GetStringTypeW
TryEnterCriticalSection
MoveFileExW
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
VerSetConditionMask
GetWindowsDirectoryW
FindResourceExW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileType
VirtualQuery
GetStdHandle
DecodePointer
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ReleaseSemaphore
WaitForSingleObject
SleepEx
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventA
CreateEventW
SetWaitableTimer
Sleep
QueueUserAPC
GetCurrentProcessId
TerminateProcess
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
OpenProcess
HeapQueryInformation
GetSystemTimeAsFileTime
GetModuleFileNameW
WaitForMultipleObjects
GetFileAttributesExW
FileTimeToLocalFileTime
VirtualProtect
GetCurrentThread
GlobalFlags
GetUserDefaultUILanguage
GetLocaleInfoW
CompareStringW
lstrcmpiW
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
GlobalFindAtomW
GlobalAddAtomW
LoadLibraryA
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
EncodePointer
SystemTimeToFileTime
FileTimeToSystemTime
GlobalGetAtomNameW
lstrcmpA
ResumeThread
SetThreadPriority
FormatMessageW
MulDiv
GlobalSize
LocalFree
LocalReAlloc
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalAlloc
OutputDebugStringA
FindResourceA
LockResource
GetCurrentThreadId
SetUnhandledExceptionFilter
GetVersionExW
CreateThread
WriteFile
MoveFileW
GetModuleHandleA
GetSystemDirectoryW
GetSystemInfo
GetCurrentProcess
lstrcpyW
GetModuleHandleW
CreateFileW
CopyFileW
SetFileAttributesW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
FindResourceW
SizeofResource
LoadResource
FreeResource
CreateMutexA
ReleaseMutex
GetTickCount
GetPrivateProfileIntW
GetModuleFileNameA
InitializeCriticalSection
GetTempPathW
DeleteFileW
CreateDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
WritePrivateProfileStringA
LoadLibraryW
LocalAlloc
GetProcAddress
FreeLibrary
CreateProcessW
DeviceIoControl
OutputDebugStringW
CreateFileA
GetEnvironmentVariableW
MultiByteToWideChar
VerifyVersionInfoW
GetPrivateProfileStringA
CreateWaitableTimerW
CreateSemaphoreA
OpenMutexA
user32
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
WaitMessage
PostThreadMessageW
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
SetWindowRgn
SetClassLongW
EnumDisplayMonitors
SetLayeredWindowAttributes
LoadMenuW
GetKeyNameTextW
MapVirtualKeyW
GetMenuDefaultItem
NotifyWinEvent
InvertRect
CopyAcceleratorTableW
SetRect
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
EndPaint
BeginPaint
GetForegroundWindow
GetClassLongW
GetClassNameW
wsprintfW
MoveWindow
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
SendMessageW
PostMessageW
PostQuitMessage
KillTimer
CreatePopupMenu
DestroyMenu
AppendMenuW
TrackPopupMenu
UpdateWindow
SetForegroundWindow
MessageBoxW
FindWindowW
InvalidateRgn
GetCaretPos
ShowCaret
CharPrevW
CharNextW
RegisterClassExW
GetCaretBlinkTime
SetCaretPos
CreateCaret
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetCursorPos
LoadIconW
UnhookWindowsHookEx
EnableWindow
IsWindowEnabled
GetParent
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
RemoveMenu
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
SetWindowsHookExW
CallNextHookEx
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
HideCaret
EnableScrollBar
MessageBeep
GetIconInfo
DrawIconEx
IsRectEmpty
DrawFocusRect
WindowFromPoint
ReleaseCapture
SetCapture
GetNextDlgGroupItem
DeleteMenu
SetCursor
ShowOwnedPopups
LoadImageW
InvalidateRect
TrackMouseEvent
IntersectRect
MapDialogRect
GetAsyncKeyState
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
OffsetRect
SetRectEmpty
SendDlgItemMessageA
CopyImage
InflateRect
GetMenuItemInfoW
FillRect
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
RealChildWindowFromPoint
GetDesktopWindow
ClientToScreen
CharUpperW
DestroyIcon
IsDialogMessageW
SetWindowTextW
CheckDlgButton
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
CreateMenu
GetWindowRgn
DestroyCursor
SetTimer
LoadCursorW
GetWindowTextW
GetWindowTextLengthW
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
RegisterWindowMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetTopWindow
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsIconic
GetDlgItem
GetDlgCtrlID
SetFocus
GetCapture
GetMenu
SetMenu
SetActiveWindow
GetScrollInfo
SetScrollInfo
GetWindow
PtInRect
gdi32
SetLayout
SetMapMode
SetBkMode
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
DeleteObject
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateDCW
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
GetLayout
Rectangle
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceW
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetTextExtentPoint32W
CreateRectRgnIndirect
PatBlt
SetRectRgn
DPtoLP
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextAlign
LPtoDP
GetTextCharsetInfo
GetObjectA
GetCharABCWidthsW
GetRgnBox
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
CopyMetaFileW
CombineRgn
winspool.drv
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
CryptEnumProvidersA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegQueryValueW
RegOpenKeyExW
RegCloseKey
StartServiceW
OpenServiceW
DeleteService
CreateServiceW
OpenSCManagerW
EnumServicesStatusA
CloseServiceHandle
RegOpenKeyW
CryptSignHashA
shell32
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetFileInfoW
ShellExecuteW
SHGetDesktopFolder
DragQueryFileW
SHAppBarMessage
SHGetPathFromIDListW
DragFinish
ole32
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromString
CoDisconnectObject
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
ReleaseStgMedium
CLSIDFromProgID
CoCreateGuid
CoTaskMemFree
OleDuplicateData
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
VariantTimeToSystemTime
VariantClear
VariantCopy
VariantChangeType
VarBstrFromDate
VariantInit
SysAllocString
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen
SysFreeString
LoadTypeLi
iphlpapi
GetExtendedTcpTable
GetAdaptersInfo
crypt32
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
shlwapi
StrFormatKBSizeW
wnsprintfW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFindExtensionW
PathRemoveFileSpecW
ws2_32
shutdown
inet_addr
gethostbyname
bind
closesocket
ioctlsocket
htonl
htons
ntohl
ntohs
setsockopt
WSAStartup
WSACleanup
WSASetLastError
WSAGetLastError
WSASend
WSASocketW
WSAStringToAddressW
select
WSARecv
listen
getaddrinfo
freeaddrinfo
__WSAFDIsSet
accept
connect
getsockname
getsockopt
WSAIoctl
gethostname
sendto
recvfrom
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
socket
getpeername
send
recv
getservbyname
mswsock
AcceptEx
GetAcceptExSockaddrs
msimg32
AlphaBlend
TransparentBlt
uxtheme
GetThemePartSize
DrawThemeText
DrawThemeParentBackground
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
gdiplus
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipAlloc
GdipCreateBitmapFromStream
GdipLoadImageFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusShutdown
GdipGetImagePaletteSize
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawPath
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipCreatePath
GdipDrawRectangleI
GdipSetPenMode
GdipDrawLineI
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipSetInterpolationMode
GdipStringFormatGetGenericTypographic
GdipCloneStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateFromHDC
GdipDrawImageRectI
GdiplusStartup
imm32
ImmGetOpenStatus
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
dbghelp
MiniDumpWriteDump
oleacc
AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject
winmm
PlaySoundW
comctl32
ord17
_TrackMouseEvent
Sections
.text Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 44KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 899KB - Virtual size: 898KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.giats Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 625KB - Virtual size: 624KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ