2024-04-27_a104131865b202299bf9123e68e50970_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-27_a104131865b202299bf9123e68e50970_magniber
Size

10.4MB
MD5

a104131865b202299bf9123e68e50970
SHA1

2ee819543fad1254c7d8fedb218ccd8efac88ea7
SHA256

66ba64207b46805fca05cdac5a57063c6a6547c93d5c5d29d6da00f42c7cade6
SHA512

730bfb08098915caee43a572489bbd4e2bfa421d8ff1634a05cd02d58cc66e1f0a104fa2b26b9a5662e3b59f7bb232fe0504d846a51d0f8e8dbb39978c26f7aa
SSDEEP

196608:0vCbSVglHYYDo6kHyMlsiUWTddddddCdddddduoU7jDf1b8hEZfR/jBsN17ruxNz:0vCIxh6kHzddddddCddddddEHbGLiR

Score

1^/10

Malware Config

Signatures

Files

2024-04-27_a104131865b202299bf9123e68e50970_magniber
.exe windows:6 windows x86 arch:x86

db03a1952a48e7d151e391c7686339a1

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:bf:4a:fe:8e:43:60:4f:83:6e:93:9c:aa:01:e1:eb
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

27/04/2023, 00:00

Not After

26/07/2026, 23:59

Subject

CN=WDS\, LLC,O=WDS\, LLC,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

72:57:d3:99:4a:1d:a6:c8:e8:12:0b:db:71:dc:81:e6:2c:7a:1e:fb
Signer

Actual PE Digest

72:57:d3:99:4a:1d:a6:c8:e8:12:0b:db:71:dc:81:e6:2c:7a:1e:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Coding\jts_napoleon\nap\napoleon\npb\cpw\Release\cpw.pdb

Imports

kernel32

LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetFileType
SetStdHandle
HeapQueryInformation
GetCommandLineW
GetCommandLineA
FreeLibraryAndExitThread
VirtualQuery
VirtualAlloc
GetSystemInfo
GetFullPathNameW
GetDriveTypeW
GetTimeZoneInformation
GetModuleHandleExW
ExitProcess
FindNextFileW
FindFirstFileExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
CompareStringEx
EnumSystemLocalesW
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
InitOnceExecuteOnce
GetTempPathW
SetFileInformationByHandle
LCMapStringEx
GetLocaleInfoEx
InitializeCriticalSectionEx
QueryPerformanceFrequency
TryAcquireSRWLockExclusive
RaiseException
OutputDebugStringW
DeleteFileW
SetCurrentDirectoryW
IsValidLocale
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
GetCurrentDirectoryW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetConsoleCtrlHandler
CreateFileW
WriteConsoleW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
SetFilePointerEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LocalUnlock
LocalLock
GetTickCount
SearchPathA
GetProfileIntA
GetTickCount64
GetTempPathA
GetUserDefaultLCID
ReplaceFileA
GetTempFileNameA
GetDiskFreeSpaceA
VerifyVersionInfoA
VerSetConditionMask
SystemTimeToTzSpecificLocalTime
SetFileTime
SetFileAttributesA
LocalFileTimeToFileTime
GetFileTime
GetFileSizeEx
GetFileAttributesExA
FileTimeToLocalFileTime
SetErrorMode
GetWindowsDirectoryA
FindResourceExW
lstrcpyA
GetStringTypeExA
MoveFileA
lstrcmpiA
GetShortPathNameA
LoadLibraryExA
GetCurrentProcess
DuplicateHandle
GetVolumeInformationA
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
CreateFileA
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
GetACP
GetCPInfo
GetOEMCP
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetAtomNameA
GlobalFlags
LocalReAlloc
LocalAlloc
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateSemaphoreA
WaitForMultipleObjects
CreateMutexA
ReleaseMutex
ReleaseSemaphore
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpA
GetCurrentThread
ResumeThread
SuspendThread
SetThreadPriority
GetVersionExA
GetCurrentProcessId
CompareStringA
GlobalGetAtomNameA
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
lstrcmpW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
OutputDebugStringA
CopyFileA
FormatMessageA
MulDiv
LocalFree
GlobalSize
SetLastError
GlobalFree
GlobalHandle
GlobalLock
GlobalUnlock
GlobalAlloc
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DecodePointer
ExitThread
CreateThread
CreateEventA
WaitForSingleObject
SetEvent
CloseHandle
GetLocalTime
GetModuleFileNameA
WinExec
GetProcAddress
GetModuleHandleA
GetCurrentDirectoryA
DeleteFileA
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
GetFileAttributesA
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
GetStringTypeW

user32

ShowOwnedPopups
PostQuitMessage
GetMessageA
IsZoomed
WindowFromPoint
SystemParametersInfoA
GetMenuItemInfoA
MapVirtualKeyA
GetKeyNameTextA
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
LoadImageA
DestroyIcon
GetWindowThreadProcessId
IntersectRect
SetRectEmpty
InsertMenuItemA
DestroyMenu
CreatePopupMenu
TranslateAcceleratorA
LoadAcceleratorsA
BringWindowToTop
ClientToScreen
ReleaseDC
GetWindowDC
GetDC
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamA
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
IsWindowEnabled
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
ShowWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
SetWindowsHookExA
GetWindow
GetLastActivePopup
GetTopWindow
GetClassNameA
GetClassLongA
SetWindowLongA
GetWindowLongA
PtInRect
MapWindowPoints
ScreenToClient
MsgWaitForMultipleObjectsEx
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
DeleteMenu
SetParent
CharUpperA
SubtractRect
SendNotifyMessageA
MonitorFromRect
GetMessagePos
RegisterWindowMessageA
GetCapture
SetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
DestroyWindow
IsChild
IsMenu
GetClassInfoExA
GetClassInfoA
RegisterClassA
TrackMouseEvent
LoadImageW
GetMenuDefaultItem
GetDCEx
LockWindowUpdate
DrawIcon
SetWindowRgn
GetNextDlgGroupItem
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
NotifyWinEvent
GetSysColorBrush
CallWindowProcA
DefWindowProcA
GetMessageTime
RealChildWindowFromPoint
CopyImage
GetAsyncKeyState
MapDialogRect
GetDialogBaseUnits
UnionRect
IsRectEmpty
AdjustWindowRectEx
GetSystemMenu
SetMenuItemInfoA
GetMenuCheckMarkDimensions
InSendMessage
CreateMenu
SetMenuItemBitmaps
WindowFromDC
GetWindowRgn
DestroyCursor
TranslateMDISysAccel
GetTabbedTextExtentA
GetTabbedTextExtentW
DefMDIChildProcA
DefFrameProcA
EnumChildWindows
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffA
RegisterClipboardFormatA
GetDoubleClickTime
SetMenuDefaultItem
CopyAcceleratorTableA
DestroyAcceleratorTable
CreateAcceleratorTableA
SetLayeredWindowAttributes
UnregisterClassA
EnableWindow
SendMessageA
PostMessageA
SetTimer
KillTimer
LoadAcceleratorsW
GetSystemMetrics
UpdateWindow
GetWindowRect
SetCursor
GetParent
LoadCursorA
GetActiveWindow
GetKeyState
LoadMenuA
DrawMenuBar
ModifyMenuA
RemoveMenu
InvalidateRect
GetClientRect
MessageBeep
GetSysColor
LoadBitmapW
IsWindow
FlashWindow
DrawTextA
DrawFocusRect
CopyRect
LoadBitmapA
LoadIconA
GetCursorPos
MessageBoxA
FillRect
GetDesktopWindow
TranslateMessage
DispatchMessageA
PeekMessageA
SetCapture
CreateWindowExA
SetWindowPos
SetRect
OffsetRect
EqualRect
MonitorFromWindow
GetMonitorInfoA
ShowScrollBar
GetCursor
DrawTextExA
GrayStringA
TabbedTextOutA
InflateRect
LoadCursorW
InvertRect
ReleaseCapture
IsWindowVisible
GetMenuStringA
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuA
AppendMenuA
UnhookWindowsHookEx
GetFocus
CheckMenuItem
EnableMenuItem
EnumDisplayMonitors
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateA
SetClassLongA
DrawEdge
DrawFrameControl
LoadMenuW
SetCursorPos
CopyIcon
FrameRect
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
PostThreadMessageA
WaitMessage
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx

gdi32

GetPixel
SelectObject
CreateCompatibleDC
DeleteDC
Escape
GetCurrentObject
PtVisible
RectVisible
TextOutA
CombineRgn
CreateRectRgnIndirect
DeleteObject
CreatePolygonRgn
Polyline
CreateSolidBrush
Ellipse
CopyMetaFileA
CreateDCA
SetBkColor
SetTextColor
CreateDIBPatternBrushPt
CreateHatchBrush
CreatePatternBrush
CreateRectRgn
ExcludeClipRect
GetClipBox
GetClipRgn
GetCurrentPositionEx
GetObjectType
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapperFlags
SetGraphicsMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
SetTextJustification
PlayMetaFileRecord
EnumMetaFile
SetWorldTransform
ModifyWorldTransform
SetColorAdjustment
StartDocA
ArcTo
CreateCompatibleBitmap
SelectClipPath
SetArcDirection
ExtCreatePen
MoveToEx
PolyBezierTo
PolylineTo
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectA
GetTextMetricsA
GetCharWidthA
GetMapMode
SetRectRgn
DPtoLP
EnumFontFamiliesExA
CreateEllipticRgn
CreateDIBSection
LPtoDP
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesA
GetTextCharsetInfo
SetPixel
SetDIBColorTable
Polygon
CreateRoundRectRgn
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
CloseMetaFile
CreateMetaFileA
DeleteMetaFile
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
GetROP2
GetBkMode
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextExtentPointA
GetTextExtentPoint32W
GetTextFaceA
CreateBitmap
StretchDIBits
StretchBlt
SetDIBitsToDevice
SetDIBits
PatBlt
GetDeviceCaps
CreatePen
CreatePalette
CreateFontA
CreateDIBitmap
BitBlt
GetObjectA
GetPaletteEntries
GetDIBits
RealizePalette
Rectangle
GetTextExtentPoint32A
GetTextColor
PolyDraw
ExtTextOutA
GetBkColor

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterA
ClosePrinter
GetJobA
DocumentPropertiesA

advapi32

RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueA
RegCreateKeyExA
GetFileSecurityA
SetFileSecurityA
RegEnumKeyExA
RegOpenKeyExW
RegEnumValueA
RegCloseKey
RegEnumKeyA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA

shell32

SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
ExtractIconA
SHAddToRecentDocs
DragFinish
DragQueryFileA
ShellExecuteA
SHGetFileInfoA
ShellExecuteExA
SHAppBarMessage

comctl32

ImageList_AddMasked
ord8

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionW
PathFindExtensionA
StrFormatKBSizeA

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeParentBackground
DrawThemeText
GetCurrentThemeName
GetWindowTheme
GetThemeColor
GetThemeSysColor

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance
CLSIDFromProgID
CoRegisterMessageFilter
CoRevokeClassObject
CoRegisterClassObject
CoGetClassObject
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
OleQueryCreateFromData
OleQueryLinkFromData
CoGetMalloc
OleIsRunning
GetRunningObjectTable
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRun
OleGetIconOfClass
OleSetContainedObject
OleSaveToStream
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateStaticFromData
OleCreateLinkFromData
OleCreateFromData
OleCreate
CreateItemMoniker
CreateGenericComposite
GetHGlobalFromILockBytes
WriteClassStm
StgCreateDocfileOnILockBytes
OleRegEnumVerbs
OleRegGetMiscStatus
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateFileMoniker
CreateILockBytesOnHGlobal
StgIsStorageFile
StgOpenStorageOnILockBytes
StgOpenStorage
StgCreateDocfile
OleLockRunning
OleSetMenuDescriptor
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
PropVariantCopy
CreateStreamOnHGlobal
CLSIDFromString
CoDisconnectObject
StringFromGUID2
CoCreateGuid
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
CreateBindCtx
CoTreatAsClass
WriteClassStg
ReadClassStg
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoInitialize

oleaut32

VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDateFromStr
VariantCopy
SafeArrayPtrOfIndex
SafeArrayCopy
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayRedim
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SafeArrayCreate
VarDecFromStr
SafeArrayAllocDescriptor
VariantTimeToSystemTime
SystemTimeToVariantTime
SysReAllocStringLen
SysStringLen
RegisterTypeLi
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysAllocString
VarBstrFromDec
SafeArrayAllocData

gdiplus

GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipFree
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipAlloc

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

mmioAdvance
mmioSetInfo
mmioGetInfo
mmioSeek
mmioWrite
mmioRead
mmioClose
mmioOpenA
mmioAscend
PlaySoundA
timeGetTime
mmioCreateChunk
mmioDescend

oledlg

ord8

msvfw32

MCIWndCreateA

dsound

ord11

bcrypt

BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptEncrypt
BCryptDestroyKey
BCryptGenRandom
BCryptSetProperty
BCryptDeriveKeyPBKDF2

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 748KB - Virtual size: 747KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db03a1952a48e7d151e391c7686339a1

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

3a:bf:4a:fe:8e:43:60:4f:83:6e:93:9c:aa:01:e1:ebCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

72:57:d3:99:4a:1d:a6:c8:e8:12:0b:db:71:dc:81:e6:2c:7a:1e:fbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

gdiplus

oleacc

imm32

winmm

oledlg

msvfw32

dsound

bcrypt

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 748KB - Virtual size: 747KB

.data Size: 67KB - Virtual size: 205KB

.rsrc Size: 5.8MB - Virtual size: 5.8MB

.reloc Size: 271KB - Virtual size: 271KB

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

3a:bf:4a:fe:8e:43:60:4f:83:6e:93:9c:aa:01:e1:eb
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

72:57:d3:99:4a:1d:a6:c8:e8:12:0b:db:71:dc:81:e6:2c:7a:1e:fb
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 748KB - Virtual size: 747KB

.data
Size: 67KB - Virtual size: 205KB

.rsrc
Size: 5.8MB - Virtual size: 5.8MB

.reloc
Size: 271KB - Virtual size: 271KB