2024-04-16_db94111655d061838274941c7eb2ef6a_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-16_db94111655d061838274941c7eb2ef6a_magniber
Size

3.3MB
MD5

db94111655d061838274941c7eb2ef6a
SHA1

1931ed175fe3e3424b8f61d4ef50277c839096ea
SHA256

eed79ec5eaccc459dfb48775125ac1277581668949ab5eb15c916d9300b640e3
SHA512

afd632747e31478a81c738926ac8a74064518142c0b5d631f55301dbd4951bb7a5dbb5163508c271d86e2de4808c058c633f742e36f5a213d533fef71d0b2b18
SSDEEP

24576:6G3PTjAoR/FqdDRK2iR3BjWsqCscXJfsX12WsW249s:6G33BgRK2HdAJfsF2WY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-16_db94111655d061838274941c7eb2ef6a_magniber

Files

2024-04-16_db94111655d061838274941c7eb2ef6a_magniber
.exe windows:5 windows x86 arch:x86

be0fa54fd9f6587a3818b6169f8bcb1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\vmagent_new\bin\joblist\524422\out\Release\update.pdb

Imports

kernel32

LoadLibraryW
GetModuleHandleW
GetVersionExW
DeleteFileW
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
Sleep
WritePrivateProfileStringW
GetTempFileNameW
SetFileAttributesW
CopyFileW
MoveFileW
MoveFileExW
GetFileSizeEx
GetLocalTime
DecodePointer
LocalAlloc
LocalFree
GetTickCount
lstrcmpiW
lstrlenW
OutputDebugStringW
GetPrivateProfileIntW
GetCommandLineW
LoadLibraryExW
GetProcAddress
FreeLibrary
Process32NextW
Process32FirstW
SetEndOfFile
WriteConsoleW
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
SetConsoleCtrlHandler
GetTimeZoneInformation
SetFilePointerEx
CreateToolhelp32Snapshot
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
GetACP
WriteFile
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
GlobalFree
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
CreateMutexW
InitializeCriticalSection
GetCurrentProcessId
OpenProcess
GetLongPathNameW
ReadFile
GetFileSize
UnlockFile
LockFile
GetFileAttributesExW
CreateFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
CloseHandle
SetFilePointer
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
GetModuleFileNameW
lstrcmpW
MulDiv
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
GetCurrentThreadId
RaiseException
GlobalUnlock
GlobalLock
GlobalAlloc
TlsAlloc
SwitchToThread
CreateEventW
EncodePointer
FormatMessageW
InterlockedDecrement
ReadConsoleW
InterlockedIncrement

user32

SendMessageW
DefWindowProcW
UnregisterClassA
DestroyCursor
SetCursor
PtInRect
EqualRect
UnionRect
OffsetRect
RegisterWindowMessageW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
IsWindow
IsChild
DestroyWindow
MoveWindow
SetWindowPos
GetDlgItem
CharNextW
SetFocus
GetFocus
SetCapture
ReleaseCapture
CreateAcceleratorTableW
DestroyAcceleratorTable
GetDC
ReleaseDC
BeginPaint
CallWindowProcW
EndPaint
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
DrawFocusRect
GetMonitorInfoW
MonitorFromWindow
MapWindowPoints
UpdateWindow
PostQuitMessage
GetAsyncKeyState
SendMessageTimeoutW
GetShellWindow
FindWindowW
SystemParametersInfoW
CopyRect
GetWindowRect
SetWindowRgn
KillTimer
SetTimer
UpdateLayeredWindow
PostMessageW
SendNotifyMessageW
GetWindowThreadProcessId
FindWindowExW
SetForegroundWindow
IsIconic
IsWindowVisible
ShowWindow
wsprintfW
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
InvalidateRect
GetSysColor
ScreenToClient
ClientToScreen
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
FillRect

gdi32

GetStockObject
RectVisible
CreateDIBSection
SelectClipRgn
SaveDC
RestoreDC
CreateRectRgnIndirect
SetViewportOrgEx
CreateRectRgn
CombineRgn
GetObjectW
SelectObject
OffsetViewportOrgEx
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
EnumFontFamiliesW
CreateFontW

advapi32

GetLengthSid
RegEnumKeyExA
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
DuplicateTokenEx
RegCloseKey
CreateWellKnownSid
SetTokenInformation
GetTokenInformation
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken

shell32

SHCreateDirectoryExW
ShellExecuteW
ShellExecuteExW

ole32

CoInitializeSecurity
CoInitializeEx
CoGetClassObject
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
OleInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoInitialize

oleaut32

DispCallFunc
LoadRegTypeLi
LoadTypeLi
VariantClear
OleCreateFontIndirect
SysAllocStringLen
VariantInit
SysAllocString
VarUI4FromStr
SysFreeString
SysStringLen

shlwapi

PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathIsRelativeW
SHGetValueW
SHSetValueW
SHSetValueA
SHGetValueA
StrToIntExW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipSetTextRenderingHint
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipFillRectangleI
GdipDrawRectangleI
GdipDrawString
GdipMeasureString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatFlags
GdipDeleteFont
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateFont
GdipSetStringFormatAlign
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatLineAlign
GdipCreateImageAttributes
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatTrimming
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipDrawImageRectRect
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

EnumProcesses
GetModuleFileNameExW

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToFileW
URLDownloadToCacheFileW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Sections

.text
Size: 764KB - Virtual size: 763KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 18KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

be0fa54fd9f6587a3818b6169f8bcb1c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

version

psapi

iphlpapi

wininet

urlmon

crypt32

wintrust

Sections

.text Size: 764KB - Virtual size: 763KB

.rdata Size: 160KB - Virtual size: 159KB

.data Size: 18KB - Virtual size: 26KB

.rsrc Size: 113KB - Virtual size: 113KB

.reloc Size: 103KB - Virtual size: 104KB

.text
Size: 764KB - Virtual size: 763KB

.rdata
Size: 160KB - Virtual size: 159KB

.data
Size: 18KB - Virtual size: 26KB

.rsrc
Size: 113KB - Virtual size: 113KB

.reloc
Size: 103KB - Virtual size: 104KB