2024-04-19_3f923d66506f97426b2eec9e3c14e703_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-19_3f923d66506f97426b2eec9e3c14e703_magniber
Size

4.1MB
MD5

3f923d66506f97426b2eec9e3c14e703
SHA1

f7daa736780fb34792a9805590ee9baac4f2c7a0
SHA256

8d0d749014200f8449b0783a921164442fb34c92d1cc441c2db08a6d3158c89e
SHA512

875414e803ba50cb89fa6569efea5e1674264674f9bb98cef37efdf41b4e14b9d5433c5e6d64f2d7b325e54e2ba342ae36350aeacfee46eda0ae72366c29f149
SSDEEP

49152:g4BbWTKLpXwdhM2EKG7AjR34vLsv+u1s7Jb2+9u6th/vL5cHJDFtGTnhx96S7kfe:goEK9QMH68LkyD5UDHFMl

Score

1^/10

Malware Config

Signatures

Files

2024-04-19_3f923d66506f97426b2eec9e3c14e703_magniber
.exe windows:4 windows x86 arch:x86

3b875f3beb32a3215004a9c3a5cc4c35

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/09/2006, 00:00

Not After

21/09/2009, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\rmtest\pc\_base\util\DRMProtectRun2.pdb

Imports

wsock32

WSACleanup
WSAStartup

kernel32

CreateProcessA
TerminateProcess
SetThreadPriority
GlobalUnlock
GetLastError
SetFileAttributesA
LoadLibraryA
Process32Next
GetModuleFileNameA
CreateMutexA
EnumResourceNamesA
CreateToolhelp32Snapshot
OutputDebugStringA
GetVersionExA
CloseHandle
ResumeThread
DeleteFileA
MapViewOfFile
UnmapViewOfFile
WaitForSingleObject
SetEvent
InitializeCriticalSection
CreateEventA
LeaveCriticalSection
EnterCriticalSection
CreateFileMappingA
GetModuleHandleA
DeleteCriticalSection
CreateThread
QueryPerformanceCounter
FindFirstFileA
FindClose
QueryPerformanceFrequency
VirtualFree
VirtualAlloc
GetCurrentProcessId
CompareStringA
GetSystemDirectoryA
InterlockedExchange
SetLastError
GetUserDefaultLCID
GetStringTypeA
GetDateFormatA
GetTimeFormatA
CreatePipe
GetExitCodeProcess
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFileAttributesA
GetConsoleOutputCP
WriteConsoleA
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapCreate
HeapDestroy
ReadFile
HeapSize
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
SetHandleCount
SetFilePointer
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
LCMapStringA
DuplicateHandle
MoveFileA
GetFullPathNameA
GetDriveTypeA
GetFileType
SetStdHandle
RaiseException
RtlUnwind
GetStartupInfoA
GetCommandLineA
ExitProcess
HeapReAlloc
ExitThread
GetSystemTimeAsFileTime
GetProcessHeap
HeapAlloc
HeapFree
SetEndOfFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
InterlockedDecrement
InterlockedIncrement
GetThreadPriority
GlobalAlloc
Sleep
GetVolumeInformationA
OpenProcess
GetWindowsDirectoryA
GetCurrentThread
GetTickCount
GlobalLock
Process32First
FreeLibrary
MoveFileExA
CreateFileA
GetLocaleInfoA
EnumSystemLocalesA
FindNextFileA
CreateDirectoryA
CopyFileA
OpenFileMappingA
IsValidLocale
SetEnvironmentVariableA
GetTimeZoneInformation
ReleaseMutex
WaitForMultipleObjects
OpenEventA
OpenMutexA
GetFileTime
SetFileTime
GetCurrentThreadId
PeekConsoleInputA
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleCtrlHandler
GetConsoleScreenBufferInfo
GetStdHandle
SetConsoleTitleA
MulDiv
AllocConsole
SetConsoleTextAttribute
ReadConsoleInputA
FreeConsole
SetConsoleCursorPosition

user32

ScreenToClient
SetClipboardData
BeginPaint
WindowFromPoint
SetCapture
ReleaseCapture
GetQueueStatus
DestroyCursor
CreateCursor
SetCursor
FillRect
EndPaint
SetFocus
PostThreadMessageA
ClientToScreen
DestroyWindow
GetMessageA
EnumDisplayMonitors
CloseClipboard
SetTimer
HideCaret
GetWindowRect
OpenIcon
PostQuitMessage
TrackPopupMenu
IsIconic
SetForegroundWindow
GetClientRect
GetWindowTextLengthA
SendMessageA
ShowCaret
RegisterWindowMessageA
EnumWindows
GetDC
TranslateMessage
GetForegroundWindow
GetWindowPlacement
GetWindowTextA
IntersectRect
MessageBoxA
BringWindowToTop
CreateWindowExA
PeekMessageA
ReleaseDC
DefWindowProcA
DestroyCaret
GetDesktopWindow
GetCursorPos
ShowWindow
CreatePopupMenu
AppendMenuA
CreateCaret
IsWindow
PostMessageA
DispatchMessageA
GetCursor
OpenClipboard
GetSystemMetrics
IsWindowVisible
SetCaretPos
SetWindowTextA
LoadImageA
AdjustWindowRect
LoadCursorA
GetWindowThreadProcessId
RegisterClassA
MoveWindow
GetSystemMenu
DeleteMenu
GetFocus
GetParent
UnregisterClassA
DrawMenuBar
FlashWindowEx

gdi32

GetTextMetricsA
GetCharABCWidthsA
GetObjectA
GetDeviceCaps
CreateFontA
StretchBlt
SetDIBitsToDevice
GetStockObject
GdiFlush
SelectClipRgn
SetTextColor
CreateFontIndirectA
IntersectClipRect
BitBlt
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
CreateCompatibleDC
SetBkMode

advapi32

RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA

ole32

CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringByteLen

wininet

InternetConnectA
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b875f3beb32a3215004a9c3a5cc4c35

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

wsock32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

winmm

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 248KB - Virtual size: 246KB

.data Size: 44KB - Virtual size: 415KB

.rsrc Size: 148KB - Virtual size: 147KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

3c:61:df:38:d5:bb:38:36:a8:b4:4b:98:5c:50:44:79
Certificate

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 248KB - Virtual size: 246KB

.data
Size: 44KB - Virtual size: 415KB

.rsrc
Size: 148KB - Virtual size: 147KB