2024-06-02_50c9bcd7ffa5300307bb453863a0ec67_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-02_50c9bcd7ffa5300307bb453863a0ec67_magniber
Size 4.2MB
Sample240602-24sghabf25
SHA256 3ba5f7d23592ff838f2b835c8b015d0ce62627b8cc71578177cf1362312ea829
MD5 50c9bcd7ffa5300307bb453863a0ec67
SHA1 b408860382b067c628b7f797d459a2a28faf7a41
SHA512 63f76226fbfe6ba3b1e00d8be44a9b05a1dd48f4ca33878749223819ecab073dbce03464b53d5eacd6b60c68b28e5f7ef9a74db28e33d69c4ea9c40d59206f3f
SSDEEP 98304:FuXBekJVI6iC2DTpMuumjwMUskDfEkKK90:EXBd2/pMula8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-02_50c9bcd7ffa5300307bb453863a0ec67_magniber

File Explorer

2024-06-02_50c9bcd7ffa5300307bb453863a0ec67_magniber

.exe 4.2MB

2024-06-02_50c9bcd7ffa5300307bb453863a0ec67_magniber

IMPHASH f8077778452df96cff92fb34fe332e80
SHA256 3ba5f7d23592ff838f2b835c8b015d0ce62627b8cc71578177cf1362312ea829
MD5 50c9bcd7ffa5300307bb453863a0ec67
SHA1 b408860382b067c628b7f797d459a2a28faf7a41
SHA512 63f76226fbfe6ba3b1e00d8be44a9b05a1dd48f4ca33878749223819ecab073dbce03464b53d5eacd6b60c68b28e5f7ef9a74db28e33d69c4ea9c40d59206f3f
SSDEEP 98304:FuXBekJVI6iC2DTpMuumjwMUskDfEkKK90:EXBd2/pMula8
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\sh\ddvsm\0128_230433\cmd\2z\out\binaries\x86ret\bin\i386\Opt\rdajgpzw.d3y\Output\msvsmon.pdb

kernel32

FreeLibrary LoadLibraryW GetComputerNameExW GetVersionExW LoadLibraryExW LocalFree GetCurrentThreadId Sleep UnmapViewOfFile CreateEventW CreateFileMappingW MapViewOfFile GetCurrentProcessId SetEvent WaitForMultipleObjectsEx GetExitCodeProcess TerminateProcess OpenProcess MultiByteToWideChar CreateThread WaitForSingleObject GetExitCodeThread GetTempPathW GetModuleFileNameW GetFileAttributesW InterlockedExchange SwitchToThread InterlockedCompareExchange GetTickCount CreateFileW GetFileSize ReadFile FindFirstFileExW FindNextFileW FindClose HeapSetInformation SetErrorMode CreateNamedPipeW WriteFile FlushFileBuffers InitializeCriticalSectionEx DisconnectNamedPipe CancelSynchronousIo GetProcessId GetCommandLineW OpenEventW SetEnvironmentVariableW WideCharToMultiByte LocalAlloc GetDateFormatW GetTimeFormatW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetLocalTime ExpandEnvironmentStringsW GetThreadLocale RaiseException lstrcmpiW SizeofResource LoadResource FindResourceW QueryFullProcessImageNameW GetLongPathNameW GetThreadContext GetCurrentThread SetLastError SetUnhandledExceptionFilter SetThreadPriority SuspendThread IsDebuggerPresent DecodePointer GetFileInformationByHandle DeleteCriticalSection GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ResumeThread CreateProcessW ConnectNamedPipe MulDiv GetCurrentProcess GetSystemDirectoryW FindFirstFileW FormatMessageA GetComputerNameW IsWow64Process GetVersion OpenFileMappingW WriteProcessMemory VirtualAllocEx DeleteFileW WaitForMultipleObjects SetThreadAffinityMask GetProcessAffinityMask GetThreadPriority SetFilePointer RegisterWaitForSingleObject UnregisterWaitEx QueueUserWorkItem OpenThread ResetEvent GetEnvironmentVariableW InitializeCriticalSection lstrcmpW FormatMessageW GetEnvironmentVariableA VirtualAlloc VirtualFree GetVersionExA FindResourceExW LockResource FindResourceA IsDBCSLeadByte lstrcmpiA GetModuleHandleA WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA OutputDebugStringW GetStringTypeW GetFileType GetACP GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle TlsFree CompareStringOrdinal TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo SetHandleInformation DuplicateHandle GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList GetLastError

vsdebugeng

DkmDllEnsureInitialized DkmDllSetRootProcessId DkmDllUninitialize ProcDkmString3

gdiplus

GdiplusShutdown

user32

GetDlgItem EnableWindow CheckDlgButton GetWindowLongW SendMessageW SetWindowLongW EndDialog SetDlgItemTextW DialogBoxParamW SetDlgItemInt GetDlgItemInt SetCursor ReleaseDC GetDC CharUpperBuffW PeekMessageW PostThreadMessageW LoadStringW PeekMessageA CharNextA MessageBoxW OpenClipboard CharNextW KillTimer SetTimer TrackPopupMenu GetCursorPos SetMenuDefaultItem GetSubMenu PostMessageW PostQuitMessage CloseClipboard SetClipboardData EmptyClipboard SetFocus GetSystemMetrics SetMenu LoadMenuW DefWindowProcW MoveWindow DestroyWindow RegisterClassW LoadIconW EnableMenuItem GetMenu SetForegroundWindow DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW UpdateWindow CreateWindowExW DestroyMenu CheckRadioButton SetWindowTextW GetParent NotifyWinEvent ShowWindow LoadCursorW

oleaut32

VarUI2FromDec VarUI4FromDec VarR4FromDec VarR8FromDec VarDecAdd VarDecSu VarDecMul VarDecDiv VarDecCmp VarBstrCmp VariantCopy SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayRedim VariantChangeType CreateErrorInfo SysAllocString VarUI1FromDec VarI1FromDec VarDecFix VarDecFromR8 VarDecFromR4 VarDecFromUI4 VarDecFromI4 GetErrorInfo VarI4FromDec VarBstrFromDec VarR8FromStr SetErrorInfo VarUI4FromStr VariantClear VarI2FromDec SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VarBstrCat VariantInit SysAllocStringLen

comctl32

ord17

ws2_32

inet_addr ntohs getsockname bind htonl closesocket setsockopt socket htons WSAStartup WSAGetLastError

gdi32

DeleteDC GetDeviceCaps SelectObject

generic

count=4, id=188, version=30716,

count=14, id=261, version=30034,

count=2, id=206, version=65500,

count=1, id=260, version=25025,

count=2, id=257, version=30146,

count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,

count=15, id=241, version=40116,

count=164, id=243, version=40116,

count=26, id=242, version=40116,

count=19, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=24, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=182, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,

count=55, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=15, id=185, version=30716,

count=527, id=1, productName=Unmarked objects,

count=1, id=259, productName=VS2019 v16.9.5 build 29915, version=29915,

count=207, id=265, version=29915,

count=1, id=256, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,