2024-04-17_c9d3b5a8fb7d38cbb50c964ebd1c99c3_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-17_c9d3b5a8fb7d38cbb50c964ebd1c99c3_magniber
Size

1.9MB
MD5

c9d3b5a8fb7d38cbb50c964ebd1c99c3
SHA1

74dce1f75b6b77cf1871bc15927848cd8ac453d4
SHA256

f5e448ffd6de7d5a7d8f56a7d47ef298e2723d476d0dcb4eb0a0ef7a11e7efba
SHA512

7113fea0d90e6e1f0abbaa2f2609ccfabc2672e3cf7e897ccecb9834901fd42e905daab8d7ec166eb08fa63cceb661bd8914aaf458335bf4f3a746582177f8e8
SSDEEP

49152:5ktERlzetzBeg2L9SgFp9B5rRAu9SlPcdORi2RNicef/rCzkb+F6SFuO:5ktERlzetzBeg2L9l9jr2ujORiH+zkbe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-17_c9d3b5a8fb7d38cbb50c964ebd1c99c3_magniber

Files

2024-04-17_c9d3b5a8fb7d38cbb50c964ebd1c99c3_magniber
.exe windows:6 windows x86 arch:x86

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AdobeIPCBroker.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
SetStdHandle
GetEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MoveFileExW
RtlCaptureStackBackTrace
InitializeCriticalSection
DeleteCriticalSection
LCMapStringW
GetCurrentThread
FormatMessageW
LocalReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
TryEnterCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
ExitProcess
GetCommandLineA
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
RaiseException
GetOverlappedResult
ConnectNamedPipe
ReadFile
FindClose
DeleteFileW
GetConsoleMode
WideCharToMultiByte
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
Sleep
WriteFile
GetFileAttributesW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetEnvironmentVariableW
TlsFree
GetTickCount
GetModuleFileNameW
SetDllDirectoryW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineW

user32

PostQuitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyWindow
SetTimer
MsgWaitForMultipleObjectsEx
DefWindowProcW
CreateWindowExW
RegisterClassW
SetWindowLongW
GetWindowLongW
GetShellWindow
EnumWindows
KillTimer
GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW
ConvertStringSidToSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
GetSidSubAuthority
GetLengthSid
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW

ws2_32

htonl
ntohs
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htons
listen
recv
select
send
socket
WSAStartup
WSAGetLastError
__WSAFDIsSet
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

crclient

advapi32

shell32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 628KB - Virtual size: 632KB