E:\workspace_git\aceview\bin\Win32\Release\pdb\AcePrinter.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-14_b61be8b0588e9d9b93c8dbafd256e99f_magniber_revil.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-05-14_b61be8b0588e9d9b93c8dbafd256e99f_magniber_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-14_b61be8b0588e9d9b93c8dbafd256e99f_magniber_revil
-
Size
2.1MB
-
MD5
b61be8b0588e9d9b93c8dbafd256e99f
-
SHA1
1a155f65ab50cfebb450ccbd14f2ae58df7571bc
-
SHA256
267cc2e4b64cef6bff9e600fd7da8ea96f1513aac1e7736718014dc54ac305be
-
SHA512
6ef35d9a504dc8d9451e12199d694c836fb3b60b7ec0f433e40396ec826c72d88be46a2f0fe941265dbe78b8d3b28b8c8c41f2f1743a2b4963599a9a56871e2a
-
SSDEEP
24576:7tPIzkQY+KpPvx3NiYc6gxOKOd79hrCAhIdUP7AAhHXESP7IhIiqs1qsOAK:78sGN7xJOdrk+HXESP7IWs0szK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-14_b61be8b0588e9d9b93c8dbafd256e99f_magniber_revil
Files
-
2024-05-14_b61be8b0588e9d9b93c8dbafd256e99f_magniber_revil.exe windows:6 windows x86 arch:x86
b68f91f89c7ba73b06565c0223c7e32b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FindFirstFileW
FindNextFileW
FindClose
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
CreateFileW
GetFileAttributesExW
SetEndOfFile
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetEnvironmentVariableW
SetEnvironmentVariableW
FormatMessageA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
LocalFree
GetLocaleInfoEx
FindFirstFileExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
QueryPerformanceCounter
LCMapStringEx
GetCPInfo
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
HeapAlloc
GetFileType
SetConsoleCtrlHandler
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapSize
WriteConsoleW
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
OpenProcess
CloseHandle
LoadLibraryExW
GetFileAttributesW
GetLastError
UnmapViewOfFile
GetDriveTypeW
GetStringTypeW
FreeLibrary
GetModuleHandleW
DeleteFiber
SetConsoleMode
ReadConsoleA
LoadLibraryA
ConvertFiberToThread
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LoadLibraryW
GetNativeSystemInfo
GetPrivateProfileStringW
GetProcAddress
advapi32
DeregisterEventSource
ReportEventW
CryptAcquireContextW
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyA
CryptEnumProvidersW
GetUserNameW
RegOpenKeyExW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
CryptReleaseContext
RegisterEventSourceW
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ole32
CoTaskMemFree
crypt32
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertGetCertificateContextProperty
bcrypt
BCryptGenRandom
user32
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ws2_32
WSACleanup
WSAGetLastError
recv
send
WSASetLastError
closesocket
Exports
Exports
CheckSigner
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 539KB - Virtual size: 538KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ