2024-05-29_d60d7bb3bff88bc1552d6643e6b14078_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-29_d60d7bb3bff88bc1552d6643e6b14078_magniber
Size 1.7MB
Sample240529-x3vs1seh4v
SHA256 e216b2f827e85722a24ed52edea964cc574a2bdd760fb1ccb835447eb810dd2b
MD5 d60d7bb3bff88bc1552d6643e6b14078
SHA1 0cf493783eff0d872df17d96e54e101f0d11cb6a
SHA512 89d3de31bfd70ef03bfdb902a79cf61ae1410d11d38924ff340c35281cc6800882a1db5268f96e7a7d1ed1c88ad226915ce2848963ffb5dde2b96af4f8c52b51
SSDEEP 49152:ewvJxyRET5lw3s2M2mkKtNxRNVnETHjr7Gw+D5Gd07lLlC08a826jifWdYBih8Et:wgDgdGX8aP27
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-05-29_d60d7bb3bff88bc1552d6643e6b14078_magniber

.exe 1.7MB

2024-05-29_d60d7bb3bff88bc1552d6643e6b14078_magniber

IMPHASH f7d35639a6628f045c50f0afa97225bd
SHA256 e216b2f827e85722a24ed52edea964cc574a2bdd760fb1ccb835447eb810dd2b
MD5 d60d7bb3bff88bc1552d6643e6b14078
SHA1 0cf493783eff0d872df17d96e54e101f0d11cb6a
SHA512 89d3de31bfd70ef03bfdb902a79cf61ae1410d11d38924ff340c35281cc6800882a1db5268f96e7a7d1ed1c88ad226915ce2848963ffb5dde2b96af4f8c52b51
SSDEEP 49152:ewvJxyRET5lw3s2M2mkKtNxRNVnETHjr7Gw+D5Gd07lLlC08a826jifWdYBih8Et:wgDgdGX8aP27
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8c:2d:0e:22:08:1c:25:d3:e6:8f:80:92:7d:02:1c:80:e1:f2:80:f5:67:5c:b0:68:99:f7:b3:4e:1a:35:4d:95

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Chains

Jun 29, 2020

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=ALCPU,O=ALCPU,POSTALCODE=67298,STREET=Snapir st. 1/12,L=Tel Aviv,ST=Tel Aviv,C=IL

Serial Number

30:20:cd:c2:db:9e:d0:be:86:6d:83:92:bb:5c:4d:0e

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 12, 2016 - Apr 12, 2021

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

33:00:00:00:35:d8:d5:59:5b:06:71:41:2b:00:00:00:00:00:35

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

574465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\330530\out\Release\360searchlite.pdb

kernel32

GetVersionExW WideCharToMultiByte MulDiv GlobalFree GlobalUnlock GlobalLock GlobalAlloc Sleep SetEvent CreateEventW GetCommandLineW WaitForMultipleObjects SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetPrivateProfileStringW ReadFile GetFileSize CreateFileW GetSystemDirectoryW GetTempFileNameW GetTempPathW DeviceIoControl GetCurrentProcessId CreateProcessW InterlockedCompareExchange UnmapViewOfFile MapViewOfFile CreateFileMappingW SetErrorMode SetFilePointer CreateFileA GetCurrentThreadId FreeLibrary LoadLibraryW GetCurrentProcess SetEnvironmentVariableA CompareStringW CompareStringA GetTimeZoneInformation SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW GetStringTypeA GetLocaleInfoA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushInstructionCache GetConsoleMode GetVersion GetStartupInfoA GetFileType SetHandleCount InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler GetModuleFileNameA GetStdHandle GetCurrentThread IsValidCodePage GetOEMCP GetACP FatalAppExitA HeapCreate GetCPInfo LCMapStringW LCMapStringA GetStartupInfoW MoveFileA RtlUnwind CreateThread ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitProcess TlsFree DeleteAtom FindAtomW TlsAlloc ReleaseMutex AddAtomW OpenThread GetAtomNameW TlsSetValue TlsGetValue GetSystemTime LocalFree GetLocalTime FormatMessageW OutputDebugStringW GetFileSizeEx WriteFile SetFilePointerEx SetEndOfFile LocalFileTimeToFileTime GetSystemTimeAsFileTime SystemTimeToFileTime lstrlenA HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedExchange FindResourceExW WaitForSingleObject GetEnvironmentVariableW GetModuleHandleA GetSystemInfo CloseHandle SetCurrentDirectoryW CreateMutexW TerminateProcess GetModuleFileNameW LoadLibraryExW MultiByteToWideChar SetLastError lstrcmpiW InterlockedDecrement InterlockedIncrement GetLastError GetConsoleCP lstrlenW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW FlushFileBuffers GetProcAddress

user32

TranslateMessage GetMessageW PeekMessageW RegisterClassExW DestroyWindow CharNextW DispatchMessageW UnregisterClassA LoadCursorW GetClassInfoExW ShowWindow MessageBoxW SendMessageW SwitchToThisWindow SetForegroundWindow BringWindowToTop PostMessageW IsIconic IsWindowEnabled FindWindowW DefWindowProcW GetActiveWindow PostQuitMessage GetWindowLongW SetWindowTextW IsZoomed SetWindowPos GetWindowRect SetTimer KillTimer SetFocus MapWindowPoints GetClientRect SetWindowLongW MonitorFromWindow GetWindow GetParent ReleaseDC GetDC CopyRect DestroyMenu TrackPopupMenu GetCursorPos GetSubMenu LoadMenuW GetWindowTextW CallWindowProcW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard RegisterClipboardFormatW DeleteMenu GetMenuStringW GetMenuItemInfoW GetMenuItemCount InsertMenuW GetMenuItemID CreatePopupMenu GetFocus AttachThreadInput GetWindowThreadProcessId GetForegroundWindow GetKeyState LoadIconW EndDialog DialogBoxParamW PrivateExtractIconsW ScreenToClient LoadImageW SetRect OffsetRect SetCursor IsWindow SetClassLongW GetClassLongW GetMessagePos IsRectEmpty PtInRect SetRectEmpty DrawTextW CreateWindowExW RegisterWindowMessageW MonitorFromRect GetSystemMetrics SystemParametersInfoW GetClipboardData GetMonitorInfoW

gdi32

GetTextMetricsW BitBlt SetViewportOrgEx CreateFontW DeleteDC GetObjectA DeleteObject CreateCompatibleBitmap CreateCompatibleDC GetPixel GetObjectW CreateFontIndirectW GetStockObject SelectObject GetTextExtentPoint32W GetDeviceCaps CreateDIBSection

advapi32

RegCloseKey RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryValueExA

shell32

ShellExecuteExW ShellExecuteW SHGetDesktopFolder ord155 SHGetFileInfoW ExtractIconExW SHOpenFolderAndSelectItems SHGetFolderPathW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree CoUninitialize CoInitialize CreateStreamOnHGlobal CLSIDFromString DoDragDrop ReleaseStgMedium OleDuplicateData CoInitializeEx

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo VarBstrCmp DispCallFunc VariantClear SysStringByteLen SysAllocStringByteLen VariantInit SysAllocString SysFreeString VarUI4FromStr CreateErrorInfo

shlwapi

SHGetValueW ColorRGBToHLS ColorHLSToRGB PathCompactPathW StrCmpNIW SHSetValueW PathRemoveFileSpecW PathFileExistsW ord176 PathCombineW PathFindExtensionW PathAppendW

comctl32

ord410 InitCommonControlsEx ord413

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipAddPathLine GdipCreateBitmapFromHBITMAP GdipSetPathGradientGammaCorrection GdipAddPathPie GdipSetInterpolationMode GdipSaveImageToFile GdipAddPathLine2 GdipGetPathWorldBoundsI GdipCreateHBITMAPFromBitmap GdipGetFontHeight GdipAddPathArc GdipSetPathGradientCenterPoint GdipCreateFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipGetFontCollectionFamilyList GdipCloneFontFamily GdipSetClipRectI GdipDrawImageRectRectI GdipDrawImageRectI GdipMeasureString GdipDrawString GdipFillRectangle GdipDrawEllipseI GdipDrawRectangleI GdipDrawLineI GdipDrawLine GdipSetPixelOffsetMode GdipGetPixelOffsetMode GdipSetTextRenderingHint GdipGetImageGraphicsContext GdipCreateFromHWNDICM GdipCreateFromHWND GdipCreatePathGradientFromPath GdipAddPathEllipseI GdipAddPathRectangleI GdipAddPathLineI GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenWidth GdipCreateLineBrushFromRect GdipBitmapSetPixel GdipBitmapGetPixel GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipDeleteFont GdipDeleteFontFamily GdipPrivateAddMemoryFont GdipDeletePrivateFontCollection GdipNewPrivateFontCollection GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipSetPathGradientCenterColor GdipDeleteStringFormat GdipCreateStringFormat GdipCreatePen2 GdipSetLinePresetBlend GdipCloneImage GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipCreateBitmapFromFileICM GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneBrush GdipFillPath GdipFillRectangleI GdipDrawPath GdipSetSmoothingMode GdipGetSmoothingMode GdipCreateFromHDC GdipAddPathArcI GdipClosePathFigure GdipResetPath GdipCreateLineBrushFromRectI GdipCreateSolidFill GdipDeleteGraphics GdipDeletePath GdipCreatePath GdipDeletePen GdipCreatePen1 GdipAlloc GdipFree GdipDeleteBrush GdipResetClip

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

crypt32

CertGetNameStringW

version

VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-29_d60d7bb3bff88bc1552d6643e6b14078_magniber

PE Signature issue

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

wintrust

crypt32

version

generic