D:\Git-repo\sogou_release\chrome\src\qb\features\setup\bin\Intermediate\QBSetupNew\Release\QBSetupNew.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_2618603164b4259a51b40b866a13cac4_avoslocker_magniber.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-29_2618603164b4259a51b40b866a13cac4_avoslocker_magniber.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-29_2618603164b4259a51b40b866a13cac4_avoslocker_magniber
-
Size
4.9MB
-
MD5
2618603164b4259a51b40b866a13cac4
-
SHA1
89b0b71a449ffd15b0b8a4a9c50a423f881c78eb
-
SHA256
3550a7b8be6322fac8cce743ace929c324ac33493950b3f39fe3b8dad364c92e
-
SHA512
6cdb8a11d0b360746cb4ee04a020bd5435bc200852c5d97a3bc8dbe475506fc5bd38176803f138e34a0b46904f3d0e2099575726c504f1c3603c1d75e94d82a4
-
SSDEEP
98304:GKMTxsIRe5Ze1CMaT1R7NB5r+7Z4qlSkVXcu6v5CoA/v46RRMpqppfnu47LydEP6:G9QZ2yhioAhSypvu47LtwVoGgLuR/
Malware Config
Signatures
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-29_2618603164b4259a51b40b866a13cac4_avoslocker_magniber
Files
-
2024-05-29_2618603164b4259a51b40b866a13cac4_avoslocker_magniber.exe windows:6 windows x86 arch:x86
300626b7dea746fea121107452b32692
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
OpenEventW
GetLocalTime
GetSystemDirectoryW
VerSetConditionMask
VerifyVersionInfoW
WriteFile
LoadLibraryW
FreeLibrary
SetCurrentDirectoryW
DecodePointer
OpenFileMappingW
lstrcmpiW
ExpandEnvironmentStringsW
FormatMessageW
WritePrivateProfileStringW
lstrcatW
lstrcpyW
ReadProcessMemory
VirtualAllocEx
VirtualQuery
GetVersionExW
GetTickCount
CreateProcessW
SuspendThread
OpenThread
GetCurrentThreadId
SwitchToThread
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
WaitForMultipleObjects
CreateEventW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetErrorMode
GetDiskFreeSpaceExW
GetBinaryTypeW
DeleteTimerQueue
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
CreateTimerQueue
LocalFree
GetSystemPowerStatus
FreeResource
GetSystemInfo
GlobalMemoryStatusEx
TerminateThread
Sleep
OpenMutexW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetFileAttributesW
CompareFileTime
Module32NextW
Module32FirstW
Thread32Next
Thread32First
CreateToolhelp32Snapshot
CreateMutexW
SetUnhandledExceptionFilter
DuplicateHandle
GetTempPathW
GetCommandLineW
LoadLibraryExW
GetProcAddress
CopyFileW
DeleteFileW
GetPrivateProfileStringW
lstrlenW
SetLastError
GetFullPathNameW
FindNextFileW
FindFirstFileW
FindClose
WideCharToMultiByte
MultiByteToWideChar
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
CloseHandle
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
CreateFileW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
GetModuleFileNameW
FindResourceExW
UnmapViewOfFile
MapViewOfFile
QueryDosDeviceW
GetExitCodeProcess
CreateFileMappingW
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetFilePointerEx
GetFileSizeEx
SetConsoleCtrlHandler
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
ReadFile
GetFileSize
WriteProcessMemory
OpenProcess
FileTimeToLocalFileTime
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ExitProcess
PeekNamedPipe
GetFileType
GetDriveTypeW
FindFirstFileExW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
GetLocaleInfoEx
CreateSymbolicLinkW
GetFileInformationByHandleEx
CloseThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
FreeLibraryWhenCallbackReturns
GetTickCount64
GetCurrentProcessorNumber
FlushProcessWriteBuffers
CreateSemaphoreExW
CreateEventExW
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
InitOnceExecuteOnce
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetFileInformationByHandle
QueryPerformanceFrequency
LCMapStringEx
GetCPInfo
CompareStringEx
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetStringTypeW
LoadLibraryExA
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
DeviceIoControl
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
VirtualProtect
K32GetMappedFileNameW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
ResumeThread
AssignProcessToJobObject
GetSystemDefaultLangID
FlushFileBuffers
QueryPerformanceCounter
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
lstrcpynW
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
GetTempFileNameW
SystemTimeToFileTime
SearchPathW
LockFileEx
UnlockFile
DeleteFileA
GetVersionExA
LoadLibraryA
CreateFileA
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
HeapCreate
AreFileApisANSI
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InitializeCriticalSectionEx
MulDiv
VirtualFree
VirtualAlloc
MoveFileExW
CreateDirectoryW
SetFilePointer
GetFileInformationByHandle
SetFileTime
SetEndOfFile
GetStdHandle
ReleaseSemaphore
ResetEvent
CreateSemaphoreW
GlobalMemoryStatus
GetWindowsDirectoryW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetShortPathNameW
GetCurrentDirectoryW
LocalAlloc
user32
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
CharNextW
SetWindowPos
EndDialog
GetClientRect
GetWindowRect
ScreenToClient
MapWindowPoints
FillRect
GetWindow
MonitorFromWindow
GetMonitorInfoW
EnumChildWindows
PtInRect
GetParent
GetSysColor
GetWindowTextW
EnableWindow
GetActiveWindow
SendMessageW
SetWindowTextW
PostThreadMessageW
LoadStringW
CreateIconFromResourceEx
MessageBoxW
GetWindowThreadProcessId
FindWindowExW
FindWindowW
GetDlgItem
RedrawWindow
MoveWindow
CharLowerW
CharPrevExA
CharUpperW
FrameRect
IsWindowVisible
SendInput
GetForegroundWindow
SetForegroundWindow
EnumWindows
SetWindowRgn
UpdateLayeredWindow
IsZoomed
IsIconic
GetDesktopWindow
DrawTextW
DrawFocusRect
SetFocus
SetCaretPos
CreateCaret
ShowCaret
GetWindowTextLengthW
GetDC
ReleaseDC
GetWindowDC
ClientToScreen
GetFocus
ShowWindow
SendMessageTimeoutW
wsprintfW
CopyRect
InvalidateRect
LoadCursorW
SetWindowLongW
GetWindowLongW
GetSystemMetrics
DestroyWindow
IsWindow
CreateWindowExW
SetCursor
UpdateWindow
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
IsRectEmpty
DestroyIcon
GetIconInfo
SetRectEmpty
LoadImageW
EndPaint
EqualRect
OffsetRect
KillTimer
SetTimer
SetCapture
ReleaseCapture
UnionRect
GetCursorPos
IntersectRect
IsWindowEnabled
BeginPaint
GetAsyncKeyState
gdi32
GetTextExtentPoint32W
DeleteObject
GetObjectW
CreateCompatibleDC
SetViewportOrgEx
CreateDIBSection
BitBlt
CreateRectRgnIndirect
SelectClipRgn
RectVisible
GetClipBox
RestoreDC
SaveDC
CreateFontIndirectW
GetStockObject
DeleteDC
MoveToEx
SelectObject
LineTo
ExtTextOutW
SetBkColor
CreateSolidBrush
GetTextMetricsW
SetBkMode
SetTextColor
CreateCompatibleBitmap
CreatePatternBrush
ExtSelectClipRgn
GetObjectA
GetBitmapBits
SetBitmapBits
GetTextExtentExPointW
GetViewportOrgEx
GetCurrentObject
SetDIBColorTable
CombineRgn
GetDeviceCaps
GetPixel
CreatePen
CreateBitmap
GetDIBits
advapi32
GetSidSubAuthorityCount
RegOpenKeyExA
GetSidSubAuthority
GetUserNameW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
ConvertSidToStringSidW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
FreeSid
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken
RegQueryValueExW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceEvent
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
CheckTokenMembership
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegEnumValueW
RegNotifyChangeKeyValue
RegEnumKeyW
CreateProcessAsUserW
DuplicateTokenEx
SetTokenInformation
GetLengthSid
GetSidIdentifierAuthority
LookupAccountNameW
RegQueryValueExA
shell32
SHBrowseForFolderW
SHGetFolderPathW
ord75
SHGetFolderLocation
SHChangeNotify
SHGetPathFromIDListW
SHGetMalloc
ord165
SHGetDesktopFolder
SHGetFileInfoW
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetSpecialFolderLocation
ShellExecuteExW
CommandLineToArgvW
ole32
CoCreateInstance
CoTaskMemFree
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateGuid
OleInitialize
OleUninitialize
PropVariantClear
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
SysAllocStringByteLen
SysAllocString
VariantClear
VariantCopy
SysFreeString
VarUI4FromStr
VariantInit
shlwapi
PathRemoveExtensionW
PathRenameExtensionW
PathFindExtensionW
PathFindFileNameW
PathIsDirectoryEmptyW
StrRetToBufW
PathCombineW
SHCopyKeyW
PathCanonicalizeW
PathRemoveFileSpecW
SHDeleteValueW
SHDeleteKeyW
PathRemoveBackslashW
PathFileExistsW
PathIsDirectoryW
SHGetValueW
PathAppendW
PathMatchSpecW
PathRemoveBlanksW
comctl32
_TrackMouseEvent
InitCommonControlsEx
msimg32
AlphaBlend
psapi
GetProcessImageFileNameW
urlmon
URLDownloadToCacheFileW
wininet
DeleteUrlCacheEntryW
gdiplus
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipSetImageAttributesWrapMode
GdipDisposeImage
GdipResetWorldTransform
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipDrawImageRectRectI
GdipCloneImage
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromResource
GdipBitmapLockBits
GdipFillEllipseI
GdipDrawEllipseI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth
GdipBitmapUnlockBits
GdipDrawImageRectI
GdipSaveImageToStream
GdipSetPenWidth
GdipGetImageThumbnail
GdipCreateBitmapFromHICON
GdipCreateHICONFromBitmap
GdipBitmapGetPixel
GdiplusStartup
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipSetTextRenderingHint
GdipDrawRectangleI
GdipFillRectangleI
GdipDrawString
GdipMeasureString
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFontSize
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreatePath
GdipDeletePath
GdipAddPathLineI
GdipAddPathArcI
GdipDrawPath
GdipFillPath
GdipCreateHBITMAPFromBitmap
GdipCreateLineBrushFromRect
GdipFillRectangle
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCloneBitmapAreaI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile
GdipDeletePen
GdipCreatePen1
GdipCreateLineBrush
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipGetImagePixelFormat
netapi32
NetGetJoinInformation
NetApiBufferFree
NetWkstaTransportEnum
Netbios
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winhttp
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpCloseHandle
WinHttpWriteData
WinHttpReceiveResponse
ws2_32
htons
htonl
ntohl
ntohs
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 365KB - Virtual size: 365KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ