2024-04-10_25e37852ba8303ae43240678b672dbae_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-10_25e37852ba8303ae43240678b672dbae_magniber
Size

4.2MB
MD5

25e37852ba8303ae43240678b672dbae
SHA1

a8f69c48421e670a42daf303c1044098f60c8415
SHA256

f0c0b43130b0e2baf59b03fc2bdbf373eb85be3c204ce900e3052cebefd46e52
SHA512

0076ed7f2562d5084b44a23ac5133eb05c6e13e4a5d5d4e8785a5d670ddcedb585e0d041b2159cf57ca7394f393596c5324cdf3593ae096e8339077043870ad6
SSDEEP

98304:K49bk8IrHVxW31GU3FsdQs0iDHJ3UtBTa8KgFj5NE:F9bkDHVxW31GU3FsdQs0iDHJ3U5FjX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-10_25e37852ba8303ae43240678b672dbae_magniber

Files

2024-04-10_25e37852ba8303ae43240678b672dbae_magniber
.exe windows:5 windows x86 arch:x86

5079f0b45ac25d197da2b51aaeef0a16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\builds\ACC\GM\source\dev\target\win32\Release\HDCore\Set-up.pdb

Imports

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_DevNode_Status
SetupDiGetDeviceInstanceIdW

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryAuthSchemes
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpSetOption
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReadData
WinHttpSetTimeouts
WinHttpReceiveResponse

wininet

InternetCanonicalizeUrlW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

kernel32

LocalAlloc
CreateFileW
GetFileAttributesW
FormatMessageW
GetDiskFreeSpaceExW
LocalFree
MoveFileExW
GetFileSize
lstrcpyW
lstrcmpiW
lstrcmpW
GetDriveTypeW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
InterlockedDecrement
GetCurrentProcessId
GetVersionExW
SizeofResource
HeapFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
HeapSize
LockResource
GlobalAlloc
HeapReAlloc
LoadResource
FindResourceW
HeapAlloc
HeapDestroy
GlobalLock
GetProcessHeap
GlobalUnlock
MulDiv
SetDllDirectoryW
CreateMutexW
ReleaseMutex
WriteFile
SetFilePointer
InitializeCriticalSection
GetFileAttributesExW
CreateSymbolicLinkW
GetFileSizeEx
GetLocalTime
GetTimeFormatW
GetDateFormatW
OpenMutexW
GetUserDefaultUILanguage
CreateEventW
SetEvent
ResetEvent
SystemTimeToFileTime
GetSystemTime
FlushFileBuffers
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
ReadFile
OutputDebugStringW
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
CreateDirectoryW
ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreW
QueryPerformanceFrequency
WaitForMultipleObjects
GlobalFree
SetLastError
VerifyVersionInfoW
GetUserDefaultLangID
CreateThread
SetNamedPipeHandleState
CreateNamedPipeW
ConnectNamedPipe
ProcessIdToSessionId
FindResourceExW
GetUserDefaultLCID
LCMapStringW
GetTimeZoneInformation
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
GetFileType
LoadLibraryExW
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
GetCPInfo
GetLocaleInfoW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
GetStringTypeW
WideCharToMultiByte
CopyFileW
FreeLibrary
CreateProcessW
GetProcAddress
LoadLibraryW
CloseHandle
Process32FirstW
DeleteFileW
Process32NextW
GetLastError
Sleep
MultiByteToWideChar
CreateToolhelp32Snapshot
SetFileAttributesW
OpenProcess
WaitForSingleObject
FindClose
GetTempPathW
GetModuleFileNameW
RemoveDirectoryW
TerminateProcess
GetCurrentProcess
FindNextFileW
FindFirstFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
VerSetConditionMask
GetFileAttributesA

user32

GetSystemMenu
GetSystemMetrics
LoadIconW
EnableMenuItem
SystemParametersInfoW
LoadImageW
PostThreadMessageW
wsprintfW
GetWindowRect
GetWindowLongW
GetWindowThreadProcessId
GetWindowTextLengthW
AllowSetForegroundWindow
LoadCursorW
GetClassNameW
SetCapture
SetWindowLongW
GetClientRect
GetDlgItem
PostQuitMessage
GetDesktopWindow
GetClassInfoExW
GetParent
RegisterWindowMessageW
ReleaseCapture
SetForegroundWindow
InvalidateRect
IsIconic
ReleaseDC
BeginPaint
EndPaint
GetWindowTextW
UnregisterClassW
GetClassLongW
AppendMenuW
GetAsyncKeyState
SetClassLongW
TranslateMessage
TranslateAcceleratorW
BringWindowToTop
GetMessageW
DefWindowProcW
CallWindowProcW
CharNextW
SetFocus
CreateAcceleratorTableW
MoveWindow
GetForegroundWindow
PostMessageW
GetWindow
GetSysColor
AttachThreadInput
IsChild
DestroyAcceleratorTable
ClientToScreen
RedrawWindow
DispatchMessageW
InvalidateRgn
IsWindow
ShowWindow
GetActiveWindow
RegisterClassExW
SetWindowTextW
SendMessageW
ScreenToClient
CreateWindowExW
FillRect
SetWindowPos
GetFocus
DestroyWindow
GetDC
MessageBoxW

gdi32

GetStockObject
DeleteDC
SelectObject
CreateCompatibleBitmap
GetObjectW
CreateSolidBrush
GetDeviceCaps
DeleteObject
CreateCompatibleDC
BitBlt

advapi32

RegFlushKey
RegCreateKeyExW
FreeSid
RegSetValueExW
LookupAccountSidW
GetUserNameW
SystemFunction036
RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
RegQueryValueExW
SetSecurityDescriptorDacl
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
AllocateAndInitializeSid
ImpersonateLoggedOnUser
ConvertStringSidToSidW
RevertToSelf
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateWellKnownSid

shell32

SHGetFolderLocation
SHGetKnownFolderPath
ShellExecuteW
CommandLineToArgvW
ord680
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
ShellExecuteExW
SHGetMalloc
SHBrowseForFolderW
SHGetSpecialFolderLocation

ole32

OleUninitialize
CoGetClassObject
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
CoReleaseServerProcess
CLSIDFromString
CoInitialize
CLSIDFromProgID
CreateStreamOnHGlobal
OleInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
CoAddRefServerProcess
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
OleRun
CoSetProxyBlanket

oleaut32

SysStringLen
VariantClear
SysAllocStringLen
SysAllocString
OleCreateFontIndirect
SysFreeString
LoadTypeLi
VariantInit
LoadRegTypeLi
SysAllocStringByteLen
VariantChangeType
VariantCopy
SysStringByteLen
DispCallFunc
GetErrorInfo

shlwapi

PathAppendW
PathIsFileSpecW
PathAddExtensionW
PathRemoveExtensionW
PathIsNetworkPathW
PathRenameExtensionW
PathIsRootW
PathAddBackslashW
PathFindFileNameW
PathStripToRootW
PathIsDirectoryW
UrlIsW
PathFileExistsW
PathRemoveFileSpecW

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain

comctl32

InitCommonControlsEx

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 298KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 632KB - Virtual size: 636KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

5079f0b45ac25d197da2b51aaeef0a16

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

winhttp

wininet

wtsapi32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

wintrust

comctl32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 298KB - Virtual size: 297KB

.data Size: 25KB - Virtual size: 49KB

.gfids Size: 1024B - Virtual size: 960B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 2.0MB - Virtual size: 2.0MB

.reloc Size: 632KB - Virtual size: 636KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 298KB - Virtual size: 297KB

.data
Size: 25KB - Virtual size: 49KB

.gfids
Size: 1024B - Virtual size: 960B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 2.0MB - Virtual size: 2.0MB

.reloc
Size: 632KB - Virtual size: 636KB