2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver

General

Target
2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver
Size 9.4MB
Sample240407-yacbmscd7t
SHA256 0ca3531e74c3e93f7f313db6fd2dd66db5cf279f869c0c64688854a8b2f08a0c
MD5 5fcd19e43a5fcfe20f6dee239392f78f
SHA1 fa7512ada7534d24588770397dab058628fcd002
SHA512 b99ec55f549ef137ff9428c7b28c49407dbc81d513ab330fae2df763fb2dd59c7b6ede835511e97cb307ecc67f1fbf6cc5d7d719e1ac6dea0b85ef43fdff6003
SSDEEP 196608:8/oQ47ZAOgxeS66w958KxcK9076tXL94VQBWG:KoQOZsx+589K2G/B
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver

File Explorer

2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver

.exe 9.4MB

2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver

IMPHASH 1d8bfbd382ef198f5cb0513e7190e116
SHA256 0ca3531e74c3e93f7f313db6fd2dd66db5cf279f869c0c64688854a8b2f08a0c
MD5 5fcd19e43a5fcfe20f6dee239392f78f
SHA1 fa7512ada7534d24588770397dab058628fcd002
SHA512 b99ec55f549ef137ff9428c7b28c49407dbc81d513ab330fae2df763fb2dd59c7b6ede835511e97cb307ecc67f1fbf6cc5d7d719e1ac6dea0b85ef43fdff6003
SSDEEP 196608:8/oQ47ZAOgxeS66w958KxcK9076tXL94VQBWG:KoQOZsx+589K2G/B
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2886908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\jenkins\workspace\N_MB5_InstallerService\bin\x64\Release\MBAMIService.pdb

kernel32

DeleteCriticalSection CreateFileW Sleep CreateDirectoryW LocalFree FormatMessageW LocalAlloc HeapAlloc GetProcessHeap HeapFree CallNamedPipeW LeaveCriticalSection EnterCriticalSection SwitchToThread GetExitCodeProcess ReadFile PeekNamedPipe TerminateProcess WaitForSingleObject ResumeThread UnmapViewOfFile MapViewOfFile OpenFileMappingW CreateFileMappingW GetProcessTimes OpenProcess CreateProcessW DeleteProcThreadAttributeList UpdateProcThreadAttribute InitializeProcThreadAttributeList GetCurrentProcessId CreateNamedPipeW GetTickCount64 SetEndOfFile SetFilePointer GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW RemoveDirectoryW DeleteFileW GetModuleHandleW GetModuleFileNameW GetNamedPipeServerProcessId GetSystemDirectoryW LoadLibraryW GetProcAddress FreeLibrary CreateEventW SetEvent CreateThread MoveFileExW DeviceIoControl MultiByteToWideChar FindFirstFileW FindNextFileW FindClose FindFirstFileExW CreateHardLinkW WriteFile WaitForMultipleObjects OpenEventW DebugBreak CreateRemoteThread VerifyVersionInfoW VerSetConditionMask GetLongPathNameW WideCharToMultiByte CopyFileW GetVersionExW GetSystemInfo CreateToolhelp32Snapshot Module32FirstW VirtualQueryEx IsWow64Process GetNativeSystemInfo Process32FirstW Process32NextW GetLogicalDriveStringsW QueryDosDeviceW GetCurrentThread FindResourceW SizeofResource DecodePointer LockResource GetFileInformationByHandle FlushFileBuffers GetTickCount GlobalAlloc GlobalFree GetFileSize GetFileSizeEx DuplicateHandle SetThreadPriority GetCurrentThreadId SetFileInformationByHandle SetSearchPathMode ExpandEnvironmentStringsW GetFileAttributesExW SetFileAttributesW GetFileAttributesW GetLocalTime GetSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FileTimeToSystemTime lstrcmpA SetFileTime SetLastError GetModuleHandleA GetStdHandle GetDriveTypeW GetSystemWindowsDirectoryW OutputDebugStringW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW CreateFileA FindResourceExW GetVersionExA GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount TryEnterCriticalSection ResetEvent ReleaseMutex CreateMutexW GetStartupInfoW GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetEnvironmentVariableW SystemTimeToFileTime SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW RaiseException InitializeCriticalSectionEx CloseHandle GetLastError LoadResource GetCurrentProcess VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW GetFullPathNameW AreFileApisANSI WaitForSingleObjectEx EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread VirtualAlloc VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx RtlPcToFileHeader ExitProcess GetModuleHandleExW ExitThread SetConsoleCtrlHandler GetCommandLineA GetCommandLineW GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP SetFilePointerEx HeapReAlloc SetStdHandle HeapSize IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW RtlUnwind

authz

AuthzFreeResourceManager AuthzAccessCheck AuthzInitializeContextFromSid AuthzInitializeResourceManager AuthzFreeContext

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

178KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

608KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2024-04-07_5fcd19e43a5fcfe20f6dee239392f78f_magniber_sliver

kernel32

authz

generic