2024-05-05_2372ae9c189ba7a0566e908985b498f4_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-05_2372ae9c189ba7a0566e908985b498f4_magniber
Size

1.6MB
MD5

2372ae9c189ba7a0566e908985b498f4
SHA1

3ebe253ea6f078580897be062ac6e5fd016169f3
SHA256

4bf55e3b2fd3da2db393dd4e5b3f99bc4329a30efdcb6456df93e1a682955627
SHA512

a1e3f1c03ab0f71a52dea1f65bb12fdb84cb6e17fe33eba2b5d0a0e14d86d1a4cb1180e9af14e134187be73fddb0ab8681d5404f95da854b2ec5e866b66bc7fb
SSDEEP

24576:MEUWpkTh8QxuGMaKGmisSSQeUG/hMXZrcekHYbwPC/YzSBiCz8:5KxuGRZs2GJMXZrcekHkw+YzRCz8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-05_2372ae9c189ba7a0566e908985b498f4_magniber

Files

2024-05-05_2372ae9c189ba7a0566e908985b498f4_magniber
.exe windows:5 windows x86 arch:x86

d392446e7757dbc4dfc9eebf6cd52a62

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Jenkins\.jenkins\workspace\hardware_info\ComputerZService\computerz_service\ComputerZService\Release\ComputerZService.pdb

Imports

kernel32

InterlockedExchange
InterlockedCompareExchange
GetCurrentThreadId
WaitForSingleObject
CloseHandle
GetLastError
SetLastError
LockResource
FreeLibrary
GetProcAddress
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
GetCurrentProcess
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FindResourceExW
WideCharToMultiByte
DecodePointer
InterlockedIncrement
InterlockedDecrement
VirtualProtect
GetCurrentProcessId
RaiseException
SetUnhandledExceptionFilter
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
lstrcmpiW
LoadLibraryExW
IsBadReadPtr
MultiByteToWideChar
GetFileSizeEx
WriteFile
ReadFile
WritePrivateProfileStringW
CreateFileW
SetFileAttributesW
GetFileAttributesW
DeleteFileW
GetShortPathNameW
GetLongPathNameW
OpenProcess
CreateMutexW
GetCommandLineW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
GetTickCount
FlushFileBuffers
ConnectNamedPipe
DisconnectNamedPipe
SetNamedPipeHandleState
GetNamedPipeInfo
CreateNamedPipeW
GetNamedPipeHandleStateW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateEventW
GetOverlappedResult
PeekNamedPipe
CancelIo
GetTimeZoneInformation
ExitProcess
GetConsoleMode
GetSystemWindowsDirectoryW
FreeResource
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
ReadConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetACP
GetConsoleCP
SetFilePointerEx
GetFileType
GetStdHandle
GetSystemInfo
VirtualQuery
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
FormatMessageW
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
ReleaseMutex
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
SetFilePointer
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
QueryPerformanceCounter
FindClose
GetSystemDirectoryW
GetWindowsDirectoryW
FindFirstFileW
FindNextFileW
GetCurrentThread
OpenThread
SetThreadPriority
GetThreadPriority
GetThreadContext
SuspendThread
ResumeThread
GetThreadSelectorEntry
InterlockedExchangeAdd
DeviceIoControl
lstrcmpA
lstrcmpiA
CreateFileA
FindFirstFileA
FindNextFileA
GetTempPathW
GetFileSize
RtlUnwind
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFileAttributesExW
SetConsoleCtrlHandler
GetModuleFileNameA

user32

PostQuitMessage
LoadCursorW
SetWindowLongW
GetWindowLongW
KillTimer
SetTimer
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostMessageW
GetWindowThreadProcessId
GetMessageW
IsWindow
SendMessageTimeoutW
CharNextW
DestroyWindow
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
wsprintfW
UnregisterClassA
FindWindowExW

oleaut32

VariantInit
VarUI4FromStr
SysAllocString
SysFreeString
VariantClear

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 167KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d392446e7757dbc4dfc9eebf6cd52a62

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 203KB - Virtual size: 203KB

.data Size: 167KB - Virtual size: 194KB

.rsrc Size: 94KB - Virtual size: 94KB

.reloc Size: 118KB - Virtual size: 120KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 203KB - Virtual size: 203KB

.data
Size: 167KB - Virtual size: 194KB

.rsrc
Size: 94KB - Virtual size: 94KB

.reloc
Size: 118KB - Virtual size: 120KB