Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-16_4a1aac3b42abe51d19cabf18ff07afec_magniber_revil.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-16_4a1aac3b42abe51d19cabf18ff07afec_magniber_revil.exe
Resource
win10v2004-20240412-en
Target
2024-04-16_4a1aac3b42abe51d19cabf18ff07afec_magniber_revil
Size
9.3MB
MD5
4a1aac3b42abe51d19cabf18ff07afec
SHA1
89ff71b5724c06543b4d66a6d53dab7fbeeb14e2
SHA256
39442170c9b041c9427921f8487048223df175cddb49e4ec1eac0aec73a8a3d3
SHA512
323e7ff099e493bb9fef82e53bd6c12abf0939e4424dd8d743d8ccf247cf0bf7216778ab082b15e25ed2d77a5af90bc1c6cc85aa76a377e0953a14a9311ccfe7
SSDEEP
196608:i07GZG9+0U5Ezm26RJ6DK4hz4pUjQJret7UOr/SleCbeCGYYfE:iiGZG9+0U5EOTUsUhr/QT+YYfE
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
C:\Jenkins\workspace\genericwinbuilder\win\Veradocs\bin\Release\Vera.pdb
GetDriveTypeW
MoveFileW
CopyFileW
MoveFileExW
ReplaceFileW
RemoveDirectoryW
GetFileAttributesExW
SetFilePointerEx
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
QueueUserWorkItem
FormatMessageW
WideCharToMultiByte
GetWindowsDirectoryW
WaitNamedPipeW
SetNamedPipeHandleState
GetOverlappedResult
LockResource
GlobalFree
lstrlenW
lstrlenA
GetLocalTime
InitOnceExecuteOnce
SetWaitableTimer
CreateWaitableTimerW
WaitForMultipleObjects
InitOnceInitialize
LocalFileTimeToFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TerminateThread
ReleaseSRWLockShared
GetThreadId
AcquireSRWLockShared
SetConsoleCtrlHandler
GetStdHandle
QueryPerformanceCounter
GetTickCount
LoadLibraryA
GlobalMemoryStatus
FlushConsoleInputBuffer
GetSystemTimeAsFileTime
GetVersion
OpenMutexW
Sleep
GetLastError
CreateMutexW
LoadLibraryExA
FlushInstructionCache
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
CreateProcessW
K32EnumProcesses
OpenProcess
K32GetProcessImageFileNameW
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameW
GetCommandLineW
GetCurrentThreadId
IsWow64Process
GetCurrentProcess
ExpandEnvironmentStringsW
FormatMessageA
GetSystemTime
GetFileSize
LockFileEx
CreateFileMappingA
VirtualLock
UnlockFile
HeapCompact
DeleteFileA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
SetFilePointer
LockFile
VirtualUnlock
GetDiskFreeSpaceW
HeapCreate
WriteFile
ReadFile
FindClose
FindNextFileW
FindFirstFileW
QueryDosDeviceW
GetLogicalDriveStringsW
GetLongPathNameW
GetFullPathNameW
DeleteFileW
GetEnvironmentVariableW
SetEnvironmentVariableW
ProcessIdToSessionId
OutputDebugStringW
CreateDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
InitializeCriticalSection
GetTempPathW
GetFileAttributesW
SetFileAttributesW
CreateFileW
GetLogicalProcessorInformation
GlobalMemoryStatusEx
GetShortPathNameW
ResetEvent
CreateEventW
SetEvent
CreateThread
GetTickCount64
TerminateProcess
GetFileType
DuplicateHandle
GetModuleHandleA
GetFinalPathNameByHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
Module32NextW
Module32FirstW
GetNamedPipeClientProcessId
ReadDirectoryChangesW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GlobalSize
GetSystemDirectoryW
OutputDebugStringA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentDirectoryW
SetEnvironmentVariableA
CreatePipe
SystemTimeToTzSpecificLocalTime
GetThreadTimes
PeekNamedPipe
ReadConsoleW
ResumeThread
ExitThread
SetStdHandle
VirtualQuery
WriteConsoleW
GetACP
GetModuleFileNameA
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
GetVersionExW
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadPriority
SignalObjectAndWait
CreateTimerQueue
GetLocaleInfoW
LCMapStringW
GetCPInfo
GetModuleHandleExW
EncodePointer
TryEnterCriticalSection
AreFileApisANSI
FindFirstFileExW
SwitchToThread
GetStringTypeW
FindResourceA
FreeResource
GetFileTime
GetCurrentProcessId
K32GetMappedFileNameW
K32GetModuleFileNameExW
GetExitCodeProcess
K32EnumProcessModulesEx
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WaitForSingleObject
VirtualFree
lstrcmpA
lstrcpyW
VirtualAlloc
LocalFree
TlsFree
CreateProcessA
TlsGetValue
GetSystemInfo
QueryPerformanceFrequency
TlsAlloc
GetCurrentThread
GetFullPathNameA
SetThreadPriority
TlsSetValue
SetHandleInformation
CompareStringW
GetBinaryTypeW
FileTimeToLocalFileTime
ConnectNamedPipe
CreateNamedPipeW
GetNamedPipeServerSessionId
GetNamedPipeClientSessionId
DisconnectNamedPipe
LocalAlloc
lstrcpynW
GetProcessId
QueryFullProcessImageNameW
VerifyVersionInfoW
VerSetConditionMask
FileTimeToSystemTime
SystemTimeToFileTime
SetLastError
LoadLibraryW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalHandle
lstrcmpW
GetComputerNameW
GetExitCodeThread
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
ExitProcess
CloseHandle
MonitorFromWindow
WaitForInputIdle
EnumWindows
GetSystemMetrics
GetWindow
CharUpperW
CloseDesktop
PeekMessageW
OpenInputDesktop
DestroyWindow
SendMessageTimeoutW
IsWindowVisible
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
GetMonitorInfoW
GetClassNameW
GetWindowTextLengthW
GetWindowTextW
IsWindowEnabled
GetWindowLongW
PostMessageW
CharLowerW
RegisterWindowMessageW
UnregisterClassW
SendMessageW
AllowSetForegroundWindow
GetUserObjectSecurity
GetWindowThreadProcessId
FindWindowW
EndDialog
MessageBoxW
GetParent
GetDesktopWindow
ReleaseDC
GetDC
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW
IsWindow
SetWindowLongW
CreateWindowExW
DefWindowProcW
SetTimer
KillTimer
GetActiveWindow
SetRect
CallWindowProcW
LoadIconW
PostQuitMessage
AppendMenuW
EnableMenuItem
CheckMenuItem
FillRect
GetCursorPos
CreatePopupMenu
InsertMenuW
SetMenuItemInfoW
GetMenuItemCount
SetForegroundWindow
TrackPopupMenu
GetAsyncKeyState
ShowWindow
DialogBoxParamW
SetWindowPos
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
DestroyAcceleratorTable
InvalidateRect
InvalidateRgn
GetClientRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
GetClassInfoExW
RedrawWindow
GetSysColor
GetDlgItem
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
RealGetWindowClassW
InflateRect
GetPropW
GetKeyState
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
LoadImageW
DestroyIcon
MapWindowPoints
GetWindowRect
SetPropW
CreateDialogParamW
EnableWindow
CheckDlgButton
IsDlgButtonChecked
GetMessagePos
SetWindowContextHelpId
SendDlgItemMessageW
MapDialogRect
ChangeWindowMessageFilterEx
ReplyMessage
UnhookWinEvent
PostThreadMessageW
SetWinEventHook
SetLayeredWindowAttributes
GetDlgCtrlID
GetTopWindow
UpdateWindow
GetScrollInfo
ScrollWindow
DrawTextW
SetScrollPos
ShowScrollBar
SetScrollInfo
WindowFromPoint
PtInRect
DeleteObject
GetDeviceCaps
SetBkMode
StretchBlt
SetBkColor
SetTextColor
CreateFontW
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
SelectObject
CreateSolidBrush
GetObjectW
GetStockObject
CreateCompatibleBitmap
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DeregisterEventSource
RegisterEventSourceA
ReportEventA
GetNamedSecurityInfoW
GetAce
GetAclInformation
SetNamedSecurityInfoW
EqualSid
LookupAccountSidW
InitializeSid
GetSidLengthRequired
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetUserNameW
ConvertSidToStringSidW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
RegEnumValueW
RegDeleteTreeW
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
GetSidSubAuthorityCount
RegNotifyChangeKeyValue
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetEffectiveRightsFromAclW
SHChangeNotify
ShellExecuteExW
Shell_NotifyIconW
SHAssocEnumHandlers
SHCreateAssociationRegistration
ord155
SHCreateDirectoryExW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
SHParseDisplayName
ShellExecuteW
OleInitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoInitializeEx
CoWaitForMultipleHandles
CoSetProxyBlanket
GetHGlobalFromStream
StringFromGUID2
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
OleUninitialize
CoUninitialize
CreateStreamOnHGlobal
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
LoadRegTypeLi
SysStringLen
SysStringByteLen
SysAllocStringByteLen
OleCreateFontIndirect
VariantInit
VarBstrCmp
GetErrorInfo
LoadTypeLi
VariantChangeType
VarUI4FromStr
DispCallFunc
SafeArrayDestroy
VariantCopy
AssocQueryStringW
PathFindFileNameW
wnsprintfW
StrStrIW
StrCmpIW
PathIsNetworkPathW
PathFileExistsW
PathStripToRootW
PathIsDirectoryW
StrCmpW
_TrackMouseEvent
ord413
ImageList_ReplaceIcon
ImageList_Create
ord412
ImageList_SetBkColor
ord410
InitCommonControlsEx
ord345
ntohs
gethostname
getnameinfo
accept
bind
ntohl
select
shutdown
listen
getaddrinfo
getsockname
htons
htonl
send
socket
connect
closesocket
WSAGetLastError
WSAStartup
WSACleanup
__WSAFDIsSet
setsockopt
recv
ioctlsocket
freeaddrinfo
getsockopt
InternetOpenUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetCrackUrlW
InternetReadFile
HttpQueryInfoA
InternetCloseHandle
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
RpcStringFreeW
UuidToStringW
UuidCreate
WNetAddConnection3W
WNetGetUniversalNameW
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsW
ord45
ord205
ord246
ord70
DavGetUNCFromHTTPPath
DsMakeSpnA
AcquireCredentialsHandleW
FreeCredentialsHandle
GetUserNameExA
InitializeSecurityContextW
FreeContextBuffer
CertGetNameStringW
CertFindCertificateInStore
CryptUnprotectData
CryptMsgClose
CertCloseStore
CryptMsgGetParam
CryptQueryObject
CertFreeCertificateContext
CertOpenStore
CryptHashCertificate
CertAddEncodedCertificateToStore
CryptProtectData
CryptDecodeObject
WinHttpGetIEProxyConfigForCurrentUser
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryOption
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle
WinHttpWriteData
WinHttpReceiveResponse
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpOpenRequest
HttpReceiveHttpRequest
HttpTerminate
HttpSetUrlGroupProperty
HttpAddUrlToUrlGroup
HttpReceiveRequestEntityBody
HttpCreateUrlGroup
HttpCreateServerSession
HttpCreateRequestQueue
HttpInitialize
HttpSendHttpResponse
CoInternetParseUrl
UnloadUserProfile
ord139
ord11
ord21
ord138
GetBufferedPaintBits
EndBufferedPaint
SetWindowTheme
BeginBufferedPaint
EvtExportLog
EvtQuery
EvtNext
EvtRender
EvtClose
GdiplusStartup
GdiplusShutdown
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapSetResolution
GdipCreateBitmapFromScan0
GdipSaveImageToStream
GdipCloneImage
GdipDisposeImage
GdipAlloc
GdipFree
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ