2024-05-25_bc82514f77b76176d107fb36addf5675_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-25_bc82514f77b76176d107fb36addf5675_mafia_magniber
Size

3.9MB
MD5

bc82514f77b76176d107fb36addf5675
SHA1

3e99c780bd3f58c5f24f5e88acae6bacf01228ea
SHA256

f5b87ef581d3c8b6249b20099d65de825baa6b48bef7043c1b82abe81e41e464
SHA512

f05028e56a11c2c3b5990016c5f466ee4cf19909b730ba4267a6ecaa754d7aa676e89841dde745194846ed68711eab15a67b8ff92bf73a6d099eee8d1d678c26
SSDEEP

49152:2KrHIaczdSZT/MfClmYsh2+RSm+8WfnH5kzT+vxHr0c+8GCm/n0h5QkzSXY40r2A:2MoacZY/Luh2+RS8WfnH5kkr0c+8qng

Score

1^/10

Malware Config

Signatures

Files

2024-05-25_bc82514f77b76176d107fb36addf5675_mafia_magniber
.exe windows:5 windows x86 arch:x86

2fcf100186d16374b28d1a01c6dbf386

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:e4:f3:47:8c:eb:8f:3b:8b:87:e0:ab:04:a7:ac:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/07/2014, 00:00

Not After

23/08/2017, 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:b7:29:67:20:54:20:19:6d:e4:c9:65:a1:2c:3d:c9:9c:1a:d8:f7
Signer

Actual PE Digest

27:b7:29:67:20:54:20:19:6d:e4:c9:65:a1:2c:3d:c9:9c:1a:d8:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Workspace\SaaYaa3\bin\saayaa.pdb

Imports

kernel32

GetProcessHeap
IsBadReadPtr
OpenProcess
VirtualFreeEx
TerminateThread
CopyFileW
ReadProcessMemory
IsBadCodePtr
TerminateProcess
WritePrivateProfileStringW
GetFileSizeEx
MoveFileW
VirtualAllocEx
LoadLibraryA
Process32FirstW
LocalAlloc
GetExitCodeThread
SetProcessWorkingSetSize
DeviceIoControl
Module32FirstW
Process32NextW
lstrcatW
OpenFileMappingW
CreateToolhelp32Snapshot
GetFileTime
QueryPerformanceFrequency
Module32NextW
ReleaseMutex
GetDiskFreeSpaceExW
FileTimeToLocalFileTime
DeleteFileA
lstrcpyA
CompareFileTime
SetUnhandledExceptionFilter
HeapAlloc
CreateProcessW
lstrcpynA
MoveFileExA
GetDriveTypeW
FreeResource
lstrcmpA
CreateMutexW
CreateFileA
GetCommandLineW
ExitProcess
GetCurrentProcessId
GetThreadPriority
GetSystemInfo
OpenThread
EnumResourceNamesW
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
GetFullPathNameA
SetStdHandle
OutputDebugStringW
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetCurrentDirectoryW
PeekNamedPipe
GetTimeZoneInformation
FlushFileBuffers
FatalAppExitA
SetConsoleCtrlHandler
SetHandleCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
IsDebuggerPresent
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetSystemTimeAsFileTime
GetDateFormatW
GetTimeFormatW
FindFirstFileExW
GetStdHandle
GetFileType
WriteConsoleW
ExitThread
DecodePointer
EncodePointer
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualProtectEx
VirtualAlloc
Sleep
VirtualFree
VirtualQuery
GetThreadContext
GetThreadSelectorEntry
GetCurrentThread
GetLogicalDrives
SetEvent
WaitForSingleObject
HeapFree
IsValidLocale
InterlockedExchange
WinExec
GetCurrentThreadId
FlushInstructionCache
MulDiv
GetFileInformationByHandle
CreateFileMappingW
GetLocalTime
FileTimeToSystemTime
UnmapViewOfFile
MapViewOfFile
LocalFileTimeToFileTime
WriteFile
SetFileTime
SystemTimeToFileTime
SetFilePointer
LocalFree
FormatMessageW
ResumeThread
SuspendThread
SetThreadPriority
ExpandEnvironmentStringsW
SetFileAttributesW
FindResourceExW
DeleteFileW
GetWindowsDirectoryW
GetShortPathNameW
RemoveDirectoryW
GetLongPathNameW
GetTempPathW
GetFileAttributesW
GetSystemDirectoryW
CreateDirectoryW
GetTempFileNameW
GetEnvironmentVariableW
GetFullPathNameW
ReadFile
FindNextFileW
FindClose
SetLastError
FindFirstFileW
CreateThread
lstrcpyW
WriteProcessMemory
CloseHandle
VirtualProtect
GlobalFree
lstrcmpiA
GetCurrentDirectoryW
GlobalUnlock
lstrcmpW
CreateFileW
lstrcpynW
GetVersionExW
WideCharToMultiByte
GlobalAlloc
InitializeCriticalSection
GetTickCount
GlobalLock
GetCurrentProcess
lstrlenA
GetFileSize
LoadLibraryW
DeleteCriticalSection
lstrcmpiW
LockResource
EnterCriticalSection
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
SizeofResource
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
QueryPerformanceCounter

user32

LoadBitmapW
IsDlgButtonChecked
CreateDialogParamW
SendMessageTimeoutW
EnumChildWindows
CheckDlgButton
LoadStringW
SendDlgItemMessageW
EndDialog
DrawStateW
EmptyClipboard
EnableMenuItem
PeekMessageW
SystemParametersInfoW
GetClipboardData
AppendMenuW
BringWindowToTop
LoadMenuW
RegisterWindowMessageW
SetRect
GetMenuItemInfoW
DrawEdge
FindWindowW
SetParent
wsprintfA
CharNextW
MoveWindow
DefWindowProcW
CreateWindowExW
ShowWindow
SetWindowPos
GetWindowRgn
SetWindowLongW
GetWindowLongW
RegisterClassExW
LoadCursorW
GetParent
GetWindowRect
DestroyWindow
MessageBoxW
wsprintfW
SetCaretPos
ShowCaret
IsWindowEnabled
GetMenuStringW
MessageBeep
CallNextHookEx
AttachThreadInput
AnimateWindow
DialogBoxParamW
DeleteMenu
LoadStringA
SetForegroundWindow
DrawIconEx
GetSubMenu
KillTimer
DrawTextW
LoadImageW
wvsprintfW
GetMenuItemID
GetWindowDC
PostQuitMessage
GetMessageW
GetAsyncKeyState
TrackPopupMenuEx
GetKeyboardLayout
GetMenuItemRect
GetWindowPlacement
LoadIconW
IsDialogMessageW
GetForegroundWindow
InflateRect
LoadAcceleratorsW
TranslateMessage
GetCapture
GetUpdateRect
GetIconInfo
GetScrollRange
InsertMenuItemW
GetActiveWindow
SetMenuInfo
GetMenuItemCount
FindWindowExW
PostMessageA
RemoveMenu
SetMenuDefaultItem
PostThreadMessageW
SetWindowsHookExW
EqualRect
OpenClipboard
AdjustWindowRectEx
UnhookWindowsHookEx
GetSystemMetrics
IsWindowVisible
RegisterClipboardFormatW
SetDlgItemTextW
SetActiveWindow
UpdateLayeredWindow
HideCaret
CreateCaret
CreateIconIndirect
CopyImage
RegisterClassW
GetMenu
SetPropW
GetPropW
UnionRect
CharPrevW
UnregisterClassA
GetDesktopWindow
ReleaseCapture
GetCursorPos
IntersectRect
OffsetRect
PtInRect
GetKeyState
ScreenToClient
GetWindow
ActivateKeyboardLayout
CallWindowProcW
GetMonitorInfoW
SetWindowTextW
DestroyMenu
EnableWindow
SendMessageW
InsertMenuW
IsWindow
CreatePopupMenu
GetSysColor
RedrawWindow
GetDlgItem
MonitorFromWindow
ReleaseDC
GetClassNameW
GetWindowTextW
InvalidateRect
GetDC
GetClassInfoExW
BeginPaint
SetFocus
CreateAcceleratorTableW
GetClientRect
InvalidateRgn
IsClipboardFormatAvailable
EnumWindows
GetClassLongW
UpdateWindow
SetClipboardData
UnregisterHotKey
GetDlgCtrlID
DestroyIcon
SetMenuItemInfoW
GetScrollPos
RegisterHotKey
CheckMenuItem
CopyRect
mouse_event
GetMessagePos
CloseClipboard
SetWindowPlacement
SetRectEmpty
GetFocus
IsZoomed
SetCapture
IsChild
FillRect
IsIconic
TrackPopupMenu
MonitorFromPoint
SetWindowRgn
DestroyAcceleratorTable
GetWindowTextLengthW
SetCursor
keybd_event
ClientToScreen
EndPaint
IsRectEmpty
PostMessageW
SetTimer
DispatchMessageW
GetWindowThreadProcessId
MapWindowPoints

gdi32

GetObjectW
CreateRoundRectRgn
GetStockObject
CreateSolidBrush
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
PtInRegion
CreateCompatibleDC
ExtTextOutW
BitBlt
CombineRgn
CreateCompatibleBitmap
SetBkMode
GetClipBox
CreatePen
ExcludeClipRect
CreatePolygonRgn
FrameRgn
GetTextExtentPoint32W
PatBlt
SetViewportOrgEx
SetTextColor
StretchBlt
SetBkColor
CreateRectRgnIndirect
GetDeviceCaps
GetCurrentObject
CreateFontIndirectW
GetObjectA
Polyline
Rectangle
CreatePatternBrush
SelectClipRgn
ExtSelectClipRgn
SetStretchBltMode
GdiFlush
GetPixel
LineTo
MoveToEx
RoundRect
TextOutW
GetCharABCWidthsW
GetTextMetricsW
SetWindowOrgEx
RestoreDC
SaveDC
SetBitmapBits
GetBitmapBits
CreateBitmap
CreateRectRgn

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

AllocateAndInitializeSid
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
FreeSid
RegEnumValueW
SetEntriesInAclW
GetNamedSecurityInfoW
LookupPrivilegeValueW
SetNamedSecurityInfoW
RegSetValueW
RegCreateKeyW
DeleteAce
GetUserNameW
OpenProcessToken
RegOpenKeyW
RegFlushKey
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW

shell32

SHGetFolderPathW
SHGetDesktopFolder
SHAppBarMessage
SHFileOperationW
SHBrowseForFolderW
Shell_NotifyIconW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListW
DragQueryFileW
ord74
CommandLineToArgvW
ShellExecuteW

ole32

StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StgCreateDocfile
OleCreateStaticFromData
CreateStreamOnHGlobal
StringFromGUID2
OleInitialize
OleUninitialize
CoGetClassObject
RevokeDragDrop
CoUninitialize
CoGetMarshalSizeMax
CoInitialize
ReleaseStgMedium
DoDragDrop
OleRun
OleDuplicateData
RegisterDragDrop
CoRegisterClassObject
CoMarshalInterface
CoUnmarshalInterface
OleSetContainedObject

oleaut32

SysStringByteLen
VarDateFromStr
VarBstrCmp
SystemTimeToVariantTime
SysAllocStringByteLen
VariantCopy
VarUdateFromDate
VariantTimeToSystemTime
LoadRegTypeLi
OleCreateFontIndirect
SysAllocStringLen
VariantInit
LoadTypeLi
VariantClear
SysStringLen
DispCallFunc
SysAllocString
SysFreeString
VarUI4FromStr
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
OleLoadPicture

shlwapi

PathFindFileNameW
PathAppendW
wvnsprintfW
StrStrIA
PathRemoveExtensionW
StrStrW
StrStrIW
StrCmpIW
PathFileExistsA
UrlCombineW
UrlCompareW
StrStrA
StrRetToBufW
SHDeleteKeyW
ord156
PathFindExtensionW
PathFileExistsW

comctl32

ImageList_Draw
ImageList_Remove
ImageList_GetImageCount
ImageList_GetIcon
ImageList_Create
ImageList_EndDrag
ImageList_DragMove
InitCommonControlsEx
ImageList_BeginDrag
ImageList_DragLeave
ImageList_AddMasked
ImageList_Add
ImageList_DragEnter
_TrackMouseEvent
ImageList_Destroy
ord17
ImageList_DragShowNolock

msimg32

AlphaBlend

wininet

FindNextUrlCacheEntryW
InternetSetCookieW
InternetOpenW
HttpSendRequestExA
HttpQueryInfoA
InternetOpenUrlA
InternetConnectA
HttpSendRequestExW
InternetSetCookieExW
InternetReadFileExA
InternetOpenUrlW
InternetReadFile
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestA
InternetSetCookieExA
HttpOpenRequestW
InternetReadFileExW
InternetSetCookieA
HttpEndRequestA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
HttpEndRequestW
InternetCloseHandle
InternetQueryOptionW
GetUrlCacheEntryInfoExW
FindNextUrlCacheGroup
InternetQueryDataAvailable
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
InternetWriteFile
InternetGetCookieExW
GetUrlCacheEntryInfoW
InternetGetCookieW
FindFirstUrlCacheEntryW
SetUrlCacheEntryInfoW
InternetGetLastResponseInfoW
DeleteUrlCacheEntryW

dbghelp

MiniDumpWriteDump
ImageDirectoryEntryToDataEx

psapi

EnumProcessModules

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

winhttp

WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCrackUrl
WinHttpReadData
WinHttpConnect

winmm

waveOutWrite

gdiplus

GdipMeasureString
GdipCreateBitmapFromHICON
GdipDrawImageRectRectI
GdipGetImageHeight
GdipCreateBitmapFromFileICM
GdipCreateFontFromLogfontA
GdipCloneBrush
GdipDeletePen
GdipSaveImageToStream
GdipSetStringFormatLineAlign
GdipDrawImageRectI
GdiplusStartup
GdipCloneImage
GdipSaveImageToFile
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipCreateBitmapFromScan0
GdipFree
GdiplusShutdown
GdipGetImagePixelFormat
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteBrush
GdipGetImageGraphicsContext
GdipSetImageAttributesWrapMode
GdipGetPropertyItem
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipLoadImageFromFile
GdipSetStringFormatAlign
GdipSetSmoothingMode
GdipGetFamily
GdipLoadImageFromFileICM
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFromHWND
GdipDeleteStringFormat
GdipCreatePen1
GdipReleaseDC
GdipGetImageWidth
GdipCreatePath
GdipCreateStringFormat
GdipDrawLineI
GdipCreateFromHWNDICM
GdipFillRectangleI
GdipBitmapLockBits
GdipSetInterpolationMode
GdipDrawImageRect
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipGetDC
GdipDrawString
GdipSetImagePalette
GdipCreateImageAttributes
GdipGetGenericFontFamilySansSerif
GdipDeletePath
GdipCreateFont
GdipSetPenWidth
GdipCreateBitmapFromFile
GdipDisposeImageAttributes
GdipDrawImageI
GdipLoadImageFromStreamICM
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipLoadImageFromStream
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipClonePath
GdipGetFontSize
GdipGetFontStyle
GdipDrawPath
GdipDrawRectangleI
GdipSetTextRenderingHint
GdipAddPathString
GdipAddPathArcI
GdipAddPathLineI
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipSetPenDashStyle
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorMatrix
GdipGetPathWorldBounds
GdipCreateHICONFromBitmap

iphlpapi

GetAdaptersInfo
GetNetworkParams
GetPerAdapterInfo
GetInterfaceInfo

urlmon

ObtainUserAgentString
UrlMkSetSessionOption
URLDownloadToFileW

dsound

ord1

crypt32

CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam

wintrust

WinVerifyTrust

mprapi

MprConfigServerConnect
MprConfigGetFriendlyName

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 659KB - Virtual size: 659KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 200KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 765KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2fcf100186d16374b28d1a01c6dbf386

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

41:e4:f3:47:8c:eb:8f:3b:8b:87:e0:ab:04:a7:ac:cfCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

27:b7:29:67:20:54:20:19:6d:e4:c9:65:a1:2c:3d:c9:9c:1a:d8:f7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

wininet

dbghelp

psapi

version

winhttp

winmm

gdiplus

iphlpapi

urlmon

dsound

crypt32

wintrust

mprapi

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 659KB - Virtual size: 659KB

.data Size: 200KB - Virtual size: 246KB

.rsrc Size: 765KB - Virtual size: 765KB

.reloc Size: 170KB - Virtual size: 170KB

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

41:e4:f3:47:8c:eb:8f:3b:8b:87:e0:ab:04:a7:ac:cf
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

27:b7:29:67:20:54:20:19:6d:e4:c9:65:a1:2c:3d:c9:9c:1a:d8:f7
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 659KB - Virtual size: 659KB

.data
Size: 200KB - Virtual size: 246KB

.rsrc
Size: 765KB - Virtual size: 765KB

.reloc
Size: 170KB - Virtual size: 170KB