2024-04-27_2488fcc9c4c8ce0542cc1594e4541073_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-27_2488fcc9c4c8ce0542cc1594e4541073_magniber
Size

1.9MB
MD5

2488fcc9c4c8ce0542cc1594e4541073
SHA1

a3ddeee89c886bdb50df21aaa6bd74be1abd3154
SHA256

efe0fab11ed8546fa2693efebf301e54f904e3477c56d2aee7588ab965e7cba9
SHA512

846b6243220e7fa802e92005421bcd300775651bc087d173e1e40d43847c758bcb7c16883800b0bbb8b4551de17bf81f24ef6f19963a0093ccdb77d277073073
SSDEEP

49152:GktERlzetzBeg2L9SgFp9B5rRAu9SlPcdORi2RNi5Dmg27RnWGj:GktERlzetzBeg2L9l9jr2ujORi5D5273

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-27_2488fcc9c4c8ce0542cc1594e4541073_magniber

Files

2024-04-27_2488fcc9c4c8ce0542cc1594e4541073_magniber
.exe windows:6 windows x86 arch:x86

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AdobeIPCBroker.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
SetStdHandle
GetEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MoveFileExW
RtlCaptureStackBackTrace
InitializeCriticalSection
DeleteCriticalSection
LCMapStringW
GetCurrentThread
FormatMessageW
LocalReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
TryEnterCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
ExitProcess
GetCommandLineA
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
RaiseException
GetOverlappedResult
ConnectNamedPipe
ReadFile
FindClose
DeleteFileW
GetConsoleMode
WideCharToMultiByte
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
Sleep
WriteFile
GetFileAttributesW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetEnvironmentVariableW
TlsFree
GetTickCount
GetModuleFileNameW
SetDllDirectoryW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineW

user32

PostQuitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyWindow
SetTimer
MsgWaitForMultipleObjectsEx
DefWindowProcW
CreateWindowExW
RegisterClassW
SetWindowLongW
GetWindowLongW
GetShellWindow
EnumWindows
KillTimer
GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW
ConvertStringSidToSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
GetSidSubAuthority
GetLengthSid
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW

ws2_32

htonl
ntohs
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htons
listen
recv
select
send
socket
WSAStartup
WSAGetLastError
__WSAFDIsSet
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

crclient

advapi32

shell32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 628KB - Virtual size: 632KB