2024-05-31_4084b9f7a3bfb4a8aba3f91647234f50_magniber_vidar

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-31_4084b9f7a3bfb4a8aba3f91647234f50_magniber_vidar
Size

8.1MB
MD5

4084b9f7a3bfb4a8aba3f91647234f50
SHA1

41dc7728be50300344d84a8db65c70e650c8eca7
SHA256

f70645374fd51174f1beb4831bc4a3a94e57b2d28de2778892590cf18bffa718
SHA512

fbd77940c4c3058d6cb4665a115bbb0a0fd0ef3a6376bf2aaff7230a82228bee66e3e201070ebaf8457a83194c4a60710698b67c93b8bc54474dfb5c2e49dde9
SSDEEP

196608:xyImxqlUgN7AktVweDOaG5eWWi/zio/i1:x+52ONwWrX/a

Score

1^/10

Malware Config

Signatures

Files

2024-05-31_4084b9f7a3bfb4a8aba3f91647234f50_magniber_vidar
.exe windows:4 windows x86 arch:x86

921eb2913f22e25825b23c831bf345e6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a6:53:9a:6b:aa:d3:3f:93:01:91:0f:b4:f4:6d:f4:72:b4:b2:87:bb:ce:a0:bc:f2:eb:29:27:63:46:15:87:9a
Signer

Actual PE Digest

a6:53:9a:6b:aa:d3:3f:93:01:91:0f:b4:f4:6d:f4:72:b4:b2:87:bb:ce:a0:bc:f2:eb:29:27:63:46:15:87:9a

Digest Algorithm

sha256

PE Digest Matches

true

26:f0:38:a1:98:b2:ff:04:50:dc:46:37:87:9e:c8:66:ff:73:30:6f
Signer

Actual PE Digest

26:f0:38:a1:98:b2:ff:04:50:dc:46:37:87:9e:c8:66:ff:73:30:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\jenkins_Trunk\workspace\SingleGameDownload_ForTest\qqpcmgr_proj\AndroidEmulator\Output\Binfinal\GameDownload\GameDownload.pdb

Imports

ws2_32

WSACleanup
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
ioctlsocket
recvfrom
WSAGetLastError
WSASocketW
setsockopt
closesocket
bind
ntohl
WSAStartup
htonl
WSAJoinLeaf
htons
inet_addr
sendto

imm32

ImmDisableIME

kernel32

FindResourceExW
RaiseException
LocalFree
SetUnhandledExceptionFilter
GetComputerNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
GetFileAttributesW
CreateFileW
GetFileSize
ReadFile
CopyFileW
GetCurrentDirectoryW
GetTempFileNameW
SetCurrentDirectoryW
DeleteFileW
CloseHandle
MoveFileExW
CreateEventW
CreateDirectoryW
SetEvent
WaitForSingleObject
GetTickCount
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
IsDBCSLeadByte
TerminateProcess
FindFirstFileW
FindNextFileW
FindClose
CreateProcessW
GetExitCodeProcess
OpenProcess
RemoveDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetACP
FormatMessageW
GetDriveTypeW
GetLogicalDrives
OutputDebugStringW
GetWindowsDirectoryW
CreatePipe
GetVersionExW
SetHandleInformation
PeekNamedPipe
FreeResource
DeviceIoControl
CreateMutexW
ReleaseMutex
LocalAlloc
InterlockedCompareExchange
GetLongPathNameW
GetLocalTime
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
TlsFree
PostQueuedCompletionStatus
TlsAlloc
CreateIoCompletionPort
TlsGetValue
TlsSetValue
SwitchToThread
GetSystemDefaultLangID
GetSystemInfo
GetModuleFileNameW
LoadLibraryA
GetVersionExA
SetFilePointer
CreateFileA
GlobalLock
GlobalAlloc
VirtualAlloc
HeapDestroy
HeapReAlloc
HeapSize
UnhandledExceptionFilter
ExitThread
CreateThread
GetStartupInfoW
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringA
LCMapStringW
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleA
ExitProcess
HeapCreate
GetStdHandle
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SizeofResource
SetLastError
LockResource
InterlockedDecrement
lstrlenA
LoadResource
InterlockedIncrement
SetHandleCount
GetCurrentProcess
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
DeleteCriticalSection
FlushInstructionCache
GetModuleHandleW
InitializeCriticalSection
GetCurrentThreadId
LeaveCriticalSection
GetCommandLineW
Sleep
EnterCriticalSection
GetVersion
GetSystemDirectoryW
lstrlenW
FreeLibrary
WideCharToMultiByte
LoadLibraryExW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
lstrcmpiW
GetLastError
InterlockedExchange
ExpandEnvironmentStringsW
FindResourceW
GetCommandLineA
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetLocaleInfoA
GetThreadLocale
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
ResetEvent
VirtualFree

user32

PostThreadMessageW
EqualRect
BeginPaint
PtInRect
DrawIconEx
MessageBoxW
MsgWaitForMultipleObjects
GetSystemMenu
FlashWindow
SetCapture
GetDlgCtrlID
SetTimer
EndPaint
SetCursor
TrackPopupMenu
ReleaseCapture
DrawTextW
DrawFrameControl
IsWindowVisible
LoadIconW
SendMessageTimeoutW
GetMonitorInfoW
SetActiveWindow
SetWindowPos
LoadCursorW
MonitorFromWindow
GetParent
KillTimer
GetClassInfoExW
IsWindowEnabled
RegisterWindowMessageW
GetWindow
SystemParametersInfoW
SetWindowTextW
PostMessageW
GetFocus
GetSysColor
GetWindowTextW
GetWindowTextLengthW
UnregisterClassW
MsgWaitForMultipleObjectsEx
GetQueueStatus
WaitMessage
RegisterClassExW
PostQuitMessage
DefWindowProcW
IsWindow
ShowWindow
TranslateMessage
SetWindowRgn
PeekMessageW
InvalidateRect
SendMessageW
GetActiveWindow
OffsetRect
InflateRect
CharNextW
DestroyWindow
ReleaseDC
CreateWindowExW
DispatchMessageW
GetKeyState
SetRect
GetWindowDC
GetDC
CopyRect
GetWindowLongW
GetMessageW
MapWindowPoints
CallWindowProcW
SetWindowLongW
ClientToScreen
GetDesktopWindow
GetClientRect
GetWindowRect
GetDlgItem
LoadStringW
LoadImageW
MoveWindow
CopyImage
UnregisterClassA
EnableWindow

gdi32

RectInRegion
MoveToEx
LineTo
SetBkMode
GetCurrentObject
GetTextExtentPoint32W
TextOutW
RoundRect
SelectClipRgn
GetClipRgn
RestoreDC
SaveDC
SetRectRgn
DeleteObject
OffsetRgn
GetStockObject
StretchBlt
GetObjectW
CreateRectRgn
CreatePen
CombineRgn
CreateBitmap
SetTextColor
Rectangle
CreateRectRgnIndirect
CreateSolidBrush
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateFontIndirectW
SelectObject
GetTextMetricsW
SetBkColor
CreateCompatibleDC
ExtTextOutW
CreateDIBSection

advapi32

RegDeleteKeyW
RegCloseKey
ControlService
CloseServiceHandle
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupPrivilegeNameW
GetTokenInformation
OpenProcessToken
RegEnumKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHFileOperationW
ShellExecuteExW
ShellExecuteW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoInitialize

oleaut32

VarUI4FromStr
SysAllocString
SysStringLen
SysFreeString
OleLoadPicture

shlwapi

PathAppendW
StrToIntA
StrStrIA
PathFindFileNameW
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
StrStrIW
SHDeleteKeyW
PathAddBackslashW
wnsprintfW

comctl32

_TrackMouseEvent

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipCreateHBITMAPFromBitmap
GdipDrawImageRectI
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdiplusStartup
GdiplusShutdown
GdipDrawImageI
GdipFree
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipLoadImageFromStream

imagehlp

MapAndLoad
UnMapAndLoad

Sections

.text
Size: 588KB - Virtual size: 585KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

921eb2913f22e25825b23c831bf345e6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

a6:53:9a:6b:aa:d3:3f:93:01:91:0f:b4:f4:6d:f4:72:b4:b2:87:bb:ce:a0:bc:f2:eb:29:27:63:46:15:87:9aSigner

26:f0:38:a1:98:b2:ff:04:50:dc:46:37:87:9e:c8:66:ff:73:30:6fSigner

Headers

File Characteristics

PDB Paths

Imports

ws2_32

imm32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imagehlp

Sections

.text Size: 588KB - Virtual size: 585KB

.rdata Size: 148KB - Virtual size: 144KB

.data Size: 20KB - Virtual size: 27KB

.rsrc Size: 7.4MB - Virtual size: 7.4MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

a6:53:9a:6b:aa:d3:3f:93:01:91:0f:b4:f4:6d:f4:72:b4:b2:87:bb:ce:a0:bc:f2:eb:29:27:63:46:15:87:9a
Signer

26:f0:38:a1:98:b2:ff:04:50:dc:46:37:87:9e:c8:66:ff:73:30:6f
Signer

.text
Size: 588KB - Virtual size: 585KB

.rdata
Size: 148KB - Virtual size: 144KB

.data
Size: 20KB - Virtual size: 27KB

.rsrc
Size: 7.4MB - Virtual size: 7.4MB