2024-04-09_2c40c2f68ee732f00cbd207bcc3742ee_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-09_2c40c2f68ee732f00cbd207bcc3742ee_magniber
Size

2.5MB
MD5

2c40c2f68ee732f00cbd207bcc3742ee
SHA1

af4cc4eba245eadc6df26b374749ff0b5025b660
SHA256

a1df6f123eaa29e0273405897d9d871b7a79a7ec7f72ff718bbeda76989636be
SHA512

411c63261539808bbc79fc0f2aa8b8dc452a36751c6d06a7b8fedba9d5f914989d24859b3a9ca78bbf6189588494652a8f94bb53e67d8b60a74f45d4ed443743
SSDEEP

49152:bCsj89zMVd8df4ixtvogqp6bJrTqkfe0jDxklPEmbM3+h:F4zLGixtApaeLkA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-09_2c40c2f68ee732f00cbd207bcc3742ee_magniber

Files

2024-04-09_2c40c2f68ee732f00cbd207bcc3742ee_magniber
.exe windows:6 windows x86 arch:x86

f4890ed364e28c37eba124c641a798f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workspace\exman-corelib_release-7.11\AdobeExtensionsService\Bin\Win\Release\AdobeExtensionsService.pdb

Imports

kernel32

CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
LockFileEx
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
UnlockFile
GetTempPathW
DuplicateHandle
CreateNamedPipeW
SetEvent
ResetEvent
WaitForSingleObject
CreateMutexW
CreateEventW
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleExW
LoadLibraryExW
WaitForMultipleObjects
GetCurrentDirectoryW
CopyFileW
MoveFileExW
FormatMessageW
LocalAlloc
LocalReAlloc
LocalFree
RaiseException
Sleep
GetCurrentThread
GetCurrentThreadId
GetTickCount
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
FreeEnvironmentStringsW
GetCommandLineW
ReadConsoleW
WriteConsoleW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleMode
GetConsoleCP
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
ExitProcess
FreeLibraryAndExitThread
ExitThread
QueryPerformanceFrequency
CreateThread
InterlockedPushEntrySList
SetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
SetStdHandle
GetStdHandle
GetEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
GetLocalTime
RtlCaptureStackBackTrace
GetOverlappedResult
ConnectNamedPipe
GetLastError
WriteFile
ReadFile
SwitchToThread
FreeLibrary
GetCurrentProcessId
GetProcAddress
LoadLibraryA
OpenProcess
CloseHandle
OutputDebugStringW
GetCurrentProcess
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
RtlUnwind
AreFileApisANSI
HeapCreate
HeapFree
GetDiskFreeSpaceW
GetNamedPipeInfo
MultiByteToWideChar
WideCharToMultiByte
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
GetModuleHandleW
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetFileAttributesW
TerminateProcess
GetStartupInfoW
GetExitCodeThread
GetTimeZoneInformation
SetEnvironmentVariableA
GetSystemInfo
GetComputerNameA
TryEnterCriticalSection
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
QueryPerformanceCounter
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
CreateFileMappingA
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA

user32

GetWindowLongW
MsgWaitForMultipleObjectsEx
RegisterClassW
PeekMessageW
GetMessageW
DefWindowProcW
DestroyWindow
CreateWindowExW
EndDialog
RegisterClassExW
LoadAcceleratorsW
LoadStringW
DispatchMessageW
TranslateAcceleratorW
TranslateMessage
LoadIconW
FindWindowW
LoadCursorW
PostQuitMessage
DialogBoxParamW
BeginPaint
EndPaint
PostMessageW
SetWindowLongW

advapi32

GetTokenInformation
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken

shell32

CommandLineToArgvW
ShellExecuteW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 369KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 648KB - Virtual size: 652KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f4890ed364e28c37eba124c641a798f2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 369KB - Virtual size: 368KB

.data Size: 51KB - Virtual size: 75KB

.gfids Size: 1024B - Virtual size: 912B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 61KB - Virtual size: 60KB

.reloc Size: 648KB - Virtual size: 652KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 369KB - Virtual size: 368KB

.data
Size: 51KB - Virtual size: 75KB

.gfids
Size: 1024B - Virtual size: 912B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 61KB - Virtual size: 60KB

.reloc
Size: 648KB - Virtual size: 652KB