Magic Bullet Suite 13[.]0[.]16 Installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Magic Bullet Suite 13.0.16 Installer.exe
Size

2.8MB
MD5

0da55abf5646d5539229a51b2281a091
SHA1

8251bb2f756583403c217236f6d60a7785e7846d
SHA256

1fc415581cb80f608612ed3d9b7efc8ad62a8ccc55be9b641faab897b6644acc
SHA512

19d76aa06badb66819394f5b3e30d1b4e14cf0d0149b640b922af2624393c7d54fc7089b67b3b59f95228925115abff3d73eda4019daae84aba40d22e998f3fd
SSDEEP

49152:pAVsArbKp1bHgHXgZbcJKhGv5dtTHEL8xAWYfagbhlytD:UFb0wAGv5hbgbhliD

Score

1^/10

Malware Config

Signatures

Files

Magic Bullet Suite 13.0.16 Installer.exe
.exe windows:6 windows x64 arch:x64

4280b30957525da33669ef29b8296b18

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

Issuer

CN=SecureTrust CA,O=SecureTrust Corporation,C=US

Not Before

01/09/2016, 14:35

Not After

29/09/2024, 14:35

Subject

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69
Certificate

Issuer

CN=Trustwave Code Signing SHA256 CA\, Level 1,O=Trustwave Holdings\, Inc.,L=Chicago,ST=Illinois,C=US,1.2.840.113549.1.9.1=#0c106361407472757374776176652e636f6d

Not Before

26/09/2018, 11:50

Not After

25/09/2020, 17:50

Subject

CN=Red Giant LLC,O=Red Giant LLC,L=Beaverton,ST=Oregon,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3b:6f:b9:8e:40:92:2a:6f:3b:1d:0d:41:0a:ad:e0:eb:12:72:11:4c
Signer

Actual PE Digest

3b:6f:b9:8e:40:92:2a:6f:3b:1d:0d:41:0a:ad:e0:eb:12:72:11:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\jobs\MagicBulletSuite_Installer_Win\workspace\stage\Magic Bullet Suite Installer.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

CreateDirectoryW
CreateFileW
LocalFree
FreeLibrary
lstrcmpiW
FindResourceW
LoadLibraryExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetCommandLineW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FindClose
FindFirstFileA
FindNextFileA
OutputDebugStringA
lstrcpyA
lstrcatA
lstrlenA
SetThreadpoolTimer
CreateThreadpoolTimer
FreeLibraryWhenCallbackReturns
GetThreadTimes
SwitchToThread
OutputDebugStringW
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
CompareStringEx
GetDateFormatEx
GetTimeFormatEx
MoveFileExW
RaiseException
GetEnvironmentStringsW
GetTickCount64
HeapReAlloc
SetEnvironmentVariableW
SetEnvironmentVariableA
SetStdHandle
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
DeleteFileW
SizeofResource
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetConsoleCP
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
SetFilePointer
GetStartupInfoW
InitOnceExecuteOnce
GetFileType
GetStdHandle
HeapSize
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
ExitThread
CreateThread
GetSystemDefaultLocaleName
SetLastError
GetVersionExW
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetModuleHandleW
GetCurrentDirectoryA
GetModuleHandleA
GetModuleFileNameA
LockResource
FreeEnvironmentStringsW
LoadResource
FreeResource
FindResourceA
GetUserDefaultLocaleName
SetEvent
CreateEventA
CreatePipe
GetEnvironmentVariableA
CreateProcessA
WaitForSingleObject
SetHandleInformation
QueryPerformanceCounter
DeleteCriticalSection
EnterCriticalSection
GetProcAddress
GetCurrentDirectoryW
LeaveCriticalSection
GetFileAttributesA
LoadLibraryW
InitializeCriticalSection
SetNamedPipeHandleState
GetLastError
ReadFile
WaitForThreadpoolTimerCallbacks
Sleep
WriteFile
GetProcessHeap
HeapFree
WaitNamedPipeA
HeapAlloc
CreateFileA
RemoveDirectoryA
MultiByteToWideChar
WideCharToMultiByte
K32GetModuleFileNameExA
K32EnumProcessModules
K32EnumProcesses
GetCPInfo
GetTimeZoneInformation
RtlUnwindEx
RtlLookupFunctionEntry
RtlPcToFileHeader
ResumeThread
ResetEvent
OpenEventA
FormatMessageA
CopyFileW
CreateDirectoryExW
AreFileApisANSI
GetModuleHandleExW
ExitProcess
CloseHandle
GetExitCodeProcess
DeviceIoControl
GetFileAttributesW
FindNextFileW
OpenProcess
FlushFileBuffers
ReadConsoleW
GetConsoleMode
IsProcessorFeaturePresent
IsDebuggerPresent
FindFirstFileW
SignalObjectAndWait
FlushProcessWriteBuffers
UnregisterWait
GetThreadPriority
GetFileAttributesExW
SetEndOfFile
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
WriteConsoleW
RegisterWaitForSingleObject
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
CreateSemaphoreExW
ReleaseSemaphore
SetThreadAffinityMask
GetProcessAffinityMask
GetLogicalProcessorInformation
GetTickCount
GetCurrentProcessorNumber
SetThreadPriority
CreateEventW
FreeLibraryAndExitThread
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
InitializeCriticalSectionEx
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
DecodePointer
DuplicateHandle
GetCurrentThread
GetExitCodeThread
EncodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetSystemTimeAsFileTime
GetLocaleInfoEx
GetStringTypeW
GetCurrentProcessId

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
SetTimer
EnableWindow
MessageBeep
MessageBoxA
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetActiveWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
UnregisterClassW
MapWindowPoints
SetWindowPos
SendMessageA
RedrawWindow
CreateWindowExW
ShowWindow
GetWindow
GetTopWindow
MoveWindow
KillTimer
GetWindowRect
PostQuitMessage
DestroyWindow
LoadIconW
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
DefWindowProcW
EndPaint
BeginPaint
SetRect
SendMessageW
LoadBitmapW
FillRect
DrawTextA
CopyRect
IsWindowEnabled
InvalidateRect
GetClientRect
SendMessageTimeoutA
GetParent

gdi32

DeleteDC
CreateFontIndirectA
CreateSolidBrush
BitBlt
GetObjectW
DeleteObject
CreateCompatibleDC
SetTextColor
SetBkColor
SelectObject
SetBkMode

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityInfo
OpenProcessToken
GetTokenInformation
RegCreateKeyExA
RegOpenKeyExA
RegGetValueA
RegEnumKeyExA
RegSetValueExA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
GetSecurityInfo
CloseServiceHandle
OpenServiceA
OpenSCManagerW
GetUserNameA
RegSetKeyValueA
RegCloseKey

shell32

CommandLineToArgvW
SHGetFolderPathA
ShellExecuteA

ole32

CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoCreateInstance
OleInitialize
OleUninitialize
CoTaskMemAlloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

gdiplus

GdipDeletePath
GdipCreatePath
GdipSetPenMode
GdipFillPath
GdipCreatePen1
GdipResetPath
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdipClosePathFigure
GdipFillRectangleI
GdipAddPathArcI
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetPageUnit
GdipDrawPath
GdipCreateSolidFill
GdiplusShutdown
GdiplusStartup
GdipDeletePen

ws2_32

gethostbyname
gethostbyaddr
socket
WSAStartup
inet_addr
htons
closesocket
WSACleanup
WSAGetLastError
sendto

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4280b30957525da33669ef29b8296b18

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54Certificate

Extended Key Usages

Key Usages

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69Certificate

Extended Key Usages

Key Usages

3b:6f:b9:8e:40:92:2a:6f:3b:1d:0d:41:0a:ad:e0:eb:12:72:11:4cSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

rpcrt4

gdiplus

ws2_32

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 380KB - Virtual size: 379KB

.data Size: 45KB - Virtual size: 80KB

.pdata Size: 69KB - Virtual size: 69KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

.reloc Size: 29KB - Virtual size: 29KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

a4:23:c0:04:a9:c7:70:15:42:30:e5:d2:71:be:06:54
Certificate

06:e5:84:f3:17:94:20:73:5d:88:7d:8e:11:5a:6c:3e:36:af:69
Certificate

3b:6f:b9:8e:40:92:2a:6f:3b:1d:0d:41:0a:ad:e0:eb:12:72:11:4c
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 380KB - Virtual size: 379KB

.data
Size: 45KB - Virtual size: 80KB

.pdata
Size: 69KB - Virtual size: 69KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

.reloc
Size: 29KB - Virtual size: 29KB