2024-05-11_99dd47345b8a842252e2fe50213356f7_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-11_99dd47345b8a842252e2fe50213356f7_mafia_magniber
Size

2.2MB
MD5

99dd47345b8a842252e2fe50213356f7
SHA1

f597e61c61a780ade362c1c907a2f147d00437de
SHA256

331acdf7c01326f7329636a116ed727b979afae1be309b9520babf9d14aeba13
SHA512

f1729cbd872dadeccd43ff2ff51c9cc00f79b247e7b4a6d63df1ac16d9f6b373077e8596d290b42cfadfb589261469ffa07a6d4b5a916b25410fc9b5f6512980
SSDEEP

49152:obCbHJclVEh3PzjKAqw9WoTHUWMhJUQ7Cwnkx2bPM26li9:5HSlm3P3KAr9cjhJt1bU26l+

Score

1^/10

Malware Config

Signatures

Files

2024-05-11_99dd47345b8a842252e2fe50213356f7_mafia_magniber
.exe windows:5 windows x86 arch:x86

9cd1245e9747bd8ac6e7b769993c2b51

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:1c:43:a4:1d:4d:dc:80:5a:85:61:c6:9c:ed:a1:82
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

16/06/2011, 00:00

Not After

15/06/2014, 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fb:20:60:0e:4a:a1:54:e5:46:af:a4:01:57:94:7b:69:5f:f4:8a:8e
Signer

Actual PE Digest

fb:20:60:0e:4a:a1:54:e5:46:af:a4:01:57:94:7b:69:5f:f4:8a:8e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\项目\TweakCube3\Release\TweakCube3.pdb

Imports

kernel32

GetFullPathNameW
lstrlenA
DeleteFileA
MoveFileExA
GetVersionExW
FileTimeToLocalFileTime
GetFileTime
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
IsBadCodePtr
WriteProcessMemory
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
GetSystemDirectoryW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetFileSizeEx
GetTempPathW
WinExec
Process32NextW
Process32FirstW
InitializeCriticalSection
DeleteCriticalSection
TerminateThread
InterlockedIncrement
InterlockedDecrement
GetStartupInfoW
CreatePipe
FreeResource
lstrcmpA
GetSystemInfo
GlobalMemoryStatusEx
SetFilePointer
lstrcmpiA
SetFileAttributesW
MoveFileW
CreateMutexW
GetCommandLineW
SetUnhandledExceptionFilter
FlushInstructionCache
MulDiv
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
LocalFree
lstrcmpW
GetCurrentProcessId
OpenProcess
GetFileSize
TerminateProcess
SetProcessWorkingSetSize
GetModuleHandleW
GetCurrentProcess
GetTickCount
GetLocalTime
GetFileInformationByHandle
FileTimeToSystemTime
WriteFile
GetVersion
FindClose
UpdateResourceW
BeginUpdateResourceW
BeginUpdateResourceA
EndUpdateResourceW
WideCharToMultiByte
LoadLibraryExW
LoadLibraryExA
FreeLibrary
GetModuleFileNameW
lstrlenW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
CreateFileW
DeviceIoControl
GetLogicalDrives
GetDriveTypeW
SetThreadPriority
SuspendThread
ResumeThread
CreateThread
CloseHandle
MultiByteToWideChar
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
RaiseException
FindNextFileW
lstrcpyW
FindFirstFileW
GetLastError
InterlockedExchange
LoadLibraryA
HeapDestroy
HeapReAlloc
SetFileTime
GetFileAttributesW
CreateDirectoryW
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
ReadFile
LoadLibraryW
GetProcAddress
CreateProcessW
WaitForSingleObject
GetTempFileNameW
MoveFileExW
DeleteFileW
GetProcessHeap
HeapAlloc
HeapFree
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
Sleep
HeapSize
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
SetCurrentDirectoryW
OutputDebugStringW
EnumResourceNamesW
CreateFileA
DecodePointer
EncodePointer
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
FindFirstFileExW
GetTimeFormatW
CopyFileW
GetCurrentThreadId
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
WriteConsoleW
SetLastError
WritePrivateProfileStringW
FlushFileBuffers
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
SetConsoleCtrlHandler
GetFullPathNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
PeekNamedPipe
FatalAppExitA
LCMapStringW
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetTimeZoneInformation
ExitProcess
HeapCreate
GetStringTypeW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetLocaleInfoW
GetStdHandle
IsDebuggerPresent
UnhandledExceptionFilter
HeapSetInformation
GetDateFormatW
LocalAlloc

gdi32

CreateFontIndirectW
CreatePen
Rectangle
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
CombineRgn
StretchBlt
SetStretchBltMode
TextOutW
SetBkMode
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
GdiFlush
ExtTextOutW
LineTo
MoveToEx
RoundRect
GetCurrentObject
PtInRegion
GetStockObject
GetObjectW
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
BitBlt
GetObjectA
CreateRectRgn
CreateDIBSection
CreateCompatibleDC
SelectObject
DeleteDC
CreateRoundRectRgn
DeleteObject
SetTextColor
GetTextMetricsW

advapi32

RegOpenKeyExW
RegDeleteValueW
RegFlushKey
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
AllocateAndInitializeSid
FreeSid
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
DeleteAce
SetNamedSecurityInfoW
RegOpenKeyW
GetUserNameW
RegEnumValueW
RegEnumKeyExW
OpenSCManagerW
GetServiceKeyNameW
OpenServiceW
CloseServiceHandle
QueryServiceConfigW
InitializeSecurityDescriptor
CreateWellKnownSid
SetEntriesInAclW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
RegQueryValueExW
RegCloseKey

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetFolderPathW
SHAppBarMessage
CommandLineToArgvW
Shell_NotifyIconW

ole32

CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoInitializeEx
StringFromCLSID
CreateStreamOnHGlobal
CoSetProxyBlanket
CLSIDFromProgID
CLSIDFromString
OleRun
CoTaskMemFree
StringFromGUID2
OleUninitialize
OleInitialize
CoGetClassObject
CoTaskMemAlloc
OleLockRunning
CoTaskMemRealloc

oleaut32

VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
DispCallFunc
SysAllocStringLen
VariantChangeType
VariantCopy
VariantInit
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo
OleLoadPicture

shlwapi

PathAppendW
PathFindFileNameW
PathFindExtensionW
wvnsprintfW
PathFileExistsW
PathRemoveExtensionW

comctl32

InitCommonControlsEx
ord17
_TrackMouseEvent

gdiplus

GdipTranslateWorldTransform
GdipSetStringFormatAlign
GdipCreateTexture
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDrawImagePointRectI
GdipDeleteFont
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdipDrawString
GdipSetTextRenderingHint
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipImageRotateFlip
GdipDrawImageI
GdipImageGetFrameDimensionsList
GdipDeleteGraphics
GdipCreateFromHDC
GdipCloneImage
GdipDisposeImage
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdipFillRectangleI
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreateFontFromLogfontA
GdiplusShutdown
GdipCreateHICONFromBitmap
GdipReleaseDC
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipClonePath
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipAddPathArcI
GdipAddPathLineI
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorMatrix
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdiplusStartup
GdipLoadImageFromStream
GdipMeasureString
GdipImageSelectActiveFrame
GdipFree
GdipImageGetFrameDimensionsCount

winmm

sndPlaySoundW

imagehlp

CheckSumMappedFile

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetReadFile
InternetOpenUrlW
InternetWriteFile
HttpSendRequestExW
HttpOpenRequestW
InternetCloseHandle
HttpEndRequestW
InternetOpenW
InternetConnectW
HttpQueryInfoW
InternetGetLastResponseInfoW
InternetQueryDataAvailable
InternetCheckConnectionW
InternetSetOptionW

urlmon

ObtainUserAgentString

ws2_32

inet_ntoa
WSAGetLastError
gethostbyname

dbghelp

MiniDumpWriteDump

riched20

ord4

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 894KB - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9cd1245e9747bd8ac6e7b769993c2b51

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6e:1c:43:a4:1d:4d:dc:80:5a:85:61:c6:9c:ed:a1:82Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fb:20:60:0e:4a:a1:54:e5:46:af:a4:01:57:94:7b:69:5f:f4:8a:8eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

winmm

imagehlp

version

wininet

urlmon

ws2_32

dbghelp

riched20

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 210KB - Virtual size: 210KB

.data Size: 18KB - Virtual size: 52KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 894KB - Virtual size: 893KB

.reloc Size: 51KB - Virtual size: 51KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6e:1c:43:a4:1d:4d:dc:80:5a:85:61:c6:9c:ed:a1:82
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fb:20:60:0e:4a:a1:54:e5:46:af:a4:01:57:94:7b:69:5f:f4:8a:8e
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 210KB - Virtual size: 210KB

.data
Size: 18KB - Virtual size: 52KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 894KB - Virtual size: 893KB

.reloc
Size: 51KB - Virtual size: 51KB