2024-05-29_02e273ed9dbca8d34b9020c62b2ff4bd_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-29_02e273ed9dbca8d34b9020c62b2ff4bd_magniber
Size

1.9MB
MD5

02e273ed9dbca8d34b9020c62b2ff4bd
SHA1

3d9fb5210a729da5c65f9a2eb34e53c84ee90867
SHA256

42eedf5994d4b30a5652ce86f219b03355b6f348f794331693f0f18c7fb2ab9e
SHA512

8fa7b68f1ca808b32b49ff742b8ce585da47cde84ebcf054a627dba85b47ce3da65d33e0c555578e08b1e2d7bb8dd1eb027ff171c934018c399fdb469e5ff68e
SSDEEP

49152:vktERlzetzBeg2L9S/Fp9B5rRAu9SlPcdORi2RNiU2/Q9boLy:vktERlzetzBeg2L9Q9jr2ujORifN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-29_02e273ed9dbca8d34b9020c62b2ff4bd_magniber

Files

2024-05-29_02e273ed9dbca8d34b9020c62b2ff4bd_magniber
.exe windows:6 windows x86 arch:x86

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AdobeIPCBroker.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
SetStdHandle
GetEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MoveFileExW
RtlCaptureStackBackTrace
InitializeCriticalSection
DeleteCriticalSection
LCMapStringW
GetCurrentThread
FormatMessageW
LocalReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
TryEnterCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
ExitProcess
GetCommandLineA
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
RaiseException
GetOverlappedResult
ConnectNamedPipe
ReadFile
FindClose
DeleteFileW
GetConsoleMode
WideCharToMultiByte
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
Sleep
WriteFile
GetFileAttributesW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetEnvironmentVariableW
TlsFree
GetTickCount
GetModuleFileNameW
SetDllDirectoryW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineW

user32

PostQuitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyWindow
SetTimer
MsgWaitForMultipleObjectsEx
DefWindowProcW
CreateWindowExW
RegisterClassW
SetWindowLongW
GetWindowLongW
GetShellWindow
EnumWindows
KillTimer
GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW
ConvertStringSidToSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
GetSidSubAuthority
GetLengthSid
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW

ws2_32

htonl
ntohs
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htons
listen
recv
select
send
socket
WSAStartup
WSAGetLastError
__WSAFDIsSet
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

crclient

advapi32

shell32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 628KB - Virtual size: 632KB