2024-04-26_0302f17317ac9872d688400bb2bbfd25_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-04-26_0302f17317ac9872d688400bb2bbfd25_magniber
Size

13.2MB
MD5

0302f17317ac9872d688400bb2bbfd25
SHA1

97c2d547aee9f7253e4eeb32520c696b6063c7d3
SHA256

14c33aa6a0f7ab361be5f99ccdc9f56f14cde20b6a526d5e26e58c94de107320
SHA512

60d8e0bf675d50aa0bca56c16e5822ddbd3794807556bc7d1d8d85cd41b1d237c5d57577cc19ad3024edc31e926f4321958d3a91a85026546d24ee1ec2fde7d6
SSDEEP

196608:HYAgzUvfvzUGZkof8M3hBiIEo0LMkxa3VFVUPsy:znvzfvf8MviIEooMsa3WJ

Score

1^/10

Malware Config

Signatures

Files

2024-04-26_0302f17317ac9872d688400bb2bbfd25_magniber
.exe windows:6 windows x86 arch:x86

abcb6b89e959cd7ec6216a5d4bc5171e

Code Sign

04:5b:d7:bd:e9:5f:97:12
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09-10-2020 11:32

Not After

09-10-2021 11:32

Subject

CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:5b:d7:bd:e9:5f:97:12
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

09-10-2020 11:32

Not After

09-10-2021 11:32

Subject

CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha 4,C=CZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03-05-2011 07:00

Not After

03-05-2031 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13-04-2011 10:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24-05-2016 00:00

Not After

24-06-2027 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

db:75:3a:14:da:87:98:7d:84:0c:f3:38:8f:9f:29:b3:5b:17:c6:49:97:f8:48:f0:3b:67:b4:77:83:66:80:15
Signer

Actual PE Digest

db:75:3a:14:da:87:98:7d:84:0c:f3:38:8f:9f:29:b3:5b:17:c6:49:97:f8:48:f0:3b:67:b4:77:83:66:80:15

Digest Algorithm

sha256

PE Digest Matches

false

b4:f9:65:81:08:c7:ee:1a:5d:7b:72:3e:75:9a:74:3d:f7:1e:fe:a5
Signer

Actual PE Digest

b4:f9:65:81:08:c7:ee:1a:5d:7b:72:3e:75:9a:74:3d:f7:1e:fe:a5

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\WS\tv_prel_dcr\build_cmake_win\FULL\Release\TeamViewer_Desktop.pdb

Imports

kernel32

LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
GetCommandLineW
GetModuleFileNameW
GetCurrentProcessId
GetProcessShutdownParameters
SetProcessShutdownParameters
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
GetLastError
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
InitializeCriticalSectionEx
DeleteCriticalSection
RaiseException
GetCurrentThreadId
DecodePointer
WaitForMultipleObjects
WaitForSingleObject
PostQueuedCompletionStatus
FormatMessageW
SetEvent
TerminateThread
CloseHandle
QueueUserAPC
LocalFree
WideCharToMultiByte
FormatMessageA
CreateEventA
GetCurrentProcess
MoveFileExW
GetTempPathW
ExpandEnvironmentStringsW
CreateDirectoryW
CreateEventW
GetUserGeoID
GetGeoInfoW
GetLocaleInfoW
GlobalMemoryStatusEx
GetComputerNameW
DeleteFileW
GetSystemTimeAsFileTime
GetUserDefaultLCID
SetLastError
SetProcessAffinityMask
GetProcessAffinityMask
GetSystemPowerStatus
VerSetConditionMask
VerifyVersionInfoW
HeapAlloc
GetProcessHeap
HeapFree
GetQueuedCompletionStatus
SetWaitableTimer
SleepEx
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
CreateWaitableTimerW
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
CreateFileW
DeviceIoControl
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
LCIDToLocaleName
SetThreadExecutionState
ReleaseSemaphore
WaitForSingleObjectEx
DuplicateHandle
CreateSemaphoreA
InitializeCriticalSection
HeapSize
HeapReAlloc
IsWow64Process
SetUnhandledExceptionFilter
FindFirstFileW
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FindClose
LoadLibraryW
CreateProcessW
GetSystemDirectoryW
WriteFile
OpenProcess
K32GetModuleBaseNameW
UnregisterWaitEx
ProcessIdToSessionId
ReadFile
ResumeThread
TerminateProcess
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32EnumProcesses
RegisterWaitForSingleObject
GetCurrentThread
GetSystemTimes
GetProcessTimes
GetSystemInfo
GetLogicalProcessorInformationEx
GetNativeSystemInfo
SetSearchPathMode
SetDllDirectoryW
HeapSetInformation
SetProcessDEPPolicy
GetFileAttributesW
GetPrivateProfileStringW
SetFileAttributesW
Sleep
LocalAlloc
CreateSemaphoreW
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
TryEnterCriticalSection
WakeAllConditionVariable
ResetEvent
IsDebuggerPresent
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CancelIoEx
CreatePipe
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetCurrentDirectoryW
SetFilePointerEx
ReleaseMutex
CreateMutexW
OpenMutexW
GetFileSize
GetPrivateProfileIntW
GetPrivateProfileSectionW
WritePrivateProfileStringW
SwitchToThread
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFileEx
OpenEventW
GetTimeZoneInformation
GetTimeFormatW
GetDateFormatW
GetLocalTime
GetTickCount64
WTSGetActiveConsoleSessionId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetEnvironmentVariableA
GetFileSizeEx
Wow64DisableWow64FsRedirection
WriteConsoleW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
VirtualProtect
VirtualQuery
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
InitOnceBeginInitialize
InitOnceComplete
InitializeSRWLock
TryAcquireSRWLockExclusive
GetStringTypeW
GetExitCodeThread
SleepConditionVariableSRW
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockShared
GetLocaleInfoEx
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
LCMapStringEx
CompareStringEx
GetCPInfo
GetEnvironmentVariableW
FlushFileBuffers
GetFileTime
RemoveDirectoryW
SetEndOfFile
GetWindowsDirectoryW
CopyFileExW
WaitForMultipleObjectsEx
OpenEventA
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
UnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
SetEnvironmentVariableW
GetFileType
GetDriveTypeW
PeekNamedPipe
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetStdHandle
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
SetStdHandle
Wow64RevertWow64FsRedirection

magnification

MagInitialize
MagSetWindowFilterList
MagSetImageScalingCallback
MagSetWindowSource
MagSetColorEffect
MagSetWindowTransform
MagUninitialize

d2d1

ord1

Sections

.text
Size: 8.6MB - Virtual size: 8.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

IPPCODE
Size: 419KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 246KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 699KB - Virtual size: 699KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

abcb6b89e959cd7ec6216a5d4bc5171e

Code Sign

04:5b:d7:bd:e9:5f:97:12Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

04:5b:d7:bd:e9:5f:97:12Certificate

Extended Key Usages

Key Usages

07Certificate

Key Usages

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

db:75:3a:14:da:87:98:7d:84:0c:f3:38:8f:9f:29:b3:5b:17:c6:49:97:f8:48:f0:3b:67:b4:77:83:66:80:15Signer

b4:f9:65:81:08:c7:ee:1a:5d:7b:72:3e:75:9a:74:3d:f7:1e:fe:a5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

magnification

d2d1

Sections

.text Size: 8.6MB - Virtual size: 8.6MB

.orpc Size: 2KB - Virtual size: 4KB

IPPCODE Size: 419KB - Virtual size: 420KB

.rdata Size: 3.3MB - Virtual size: 3.3MB

.data Size: 246KB - Virtual size: 316KB

.didat Size: 2KB - Virtual size: 4KB

.rodata Size: 2KB - Virtual size: 4KB

.rsrc Size: 699KB - Virtual size: 699KB

04:5b:d7:bd:e9:5f:97:12
Certificate

07
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

04:5b:d7:bd:e9:5f:97:12
Certificate

07
Certificate

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

db:75:3a:14:da:87:98:7d:84:0c:f3:38:8f:9f:29:b3:5b:17:c6:49:97:f8:48:f0:3b:67:b4:77:83:66:80:15
Signer

b4:f9:65:81:08:c7:ee:1a:5d:7b:72:3e:75:9a:74:3d:f7:1e:fe:a5
Signer

.text
Size: 8.6MB - Virtual size: 8.6MB

.orpc
Size: 2KB - Virtual size: 4KB

IPPCODE
Size: 419KB - Virtual size: 420KB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 246KB - Virtual size: 316KB

.didat
Size: 2KB - Virtual size: 4KB

.rodata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 699KB - Virtual size: 699KB