2024-06-02_d31f16ac5fe94ed902fd8e1085993cdc_floxif_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-02_d31f16ac5fe94ed902fd8e1085993cdc_floxif_magniber
Size 1.1MB
Sample240602-2djrnsad58
SHA256 352683284a05d2f8914fa4ab2ab5e6931500d0faa77aa063663f5e4793c0d6c6
MD5 d31f16ac5fe94ed902fd8e1085993cdc
SHA1 17ccac8ac1e9de11879fd006431eb2c560200769
SHA512 cb8b4445bb9528c0ddd9e5f88970df087e617d42672b169881fa8883e7962836cbb9f5b2ac18b30297ff47fcd624e589a7f7b571bc6a7d412d61e6e334dcbb27
SSDEEP 24576:Zuh3MZ1z5SmBJ5cIlzAaUPGwXGnBvCELsEbtAY/vwlrmxe4dQ2phzLXqphrY7Jdf:w35JJNewjU7JdUT1EefQNF7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-02_d31f16ac5fe94ed902fd8e1085993cdc_floxif_magniber

.exe 1.1MB

2024-06-02_d31f16ac5fe94ed902fd8e1085993cdc_floxif_magniber

IMPHASH dc483e4cf899829e866c5f87e01ec900
SHA256 352683284a05d2f8914fa4ab2ab5e6931500d0faa77aa063663f5e4793c0d6c6
MD5 d31f16ac5fe94ed902fd8e1085993cdc
SHA1 17ccac8ac1e9de11879fd006431eb2c560200769
SHA512 cb8b4445bb9528c0ddd9e5f88970df087e617d42672b169881fa8883e7962836cbb9f5b2ac18b30297ff47fcd624e589a7f7b571bc6a7d412d61e6e334dcbb27
SSDEEP 24576:Zuh3MZ1z5SmBJ5cIlzAaUPGwXGnBvCELsEbtAY/vwlrmxe4dQ2phzLXqphrY7Jdf:w35JJNewjU7JdUT1EefQNF7
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

d0:45:a1:c4:ff:e8:f7:c8:ff:47:8d:3e:77:4a:dc:16:fc:eb:6a:c5:44:b4:48:c5:b1:f5:e6:04:15:29:e3:3f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 2, 2021

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

d8:9f:d7:82:3b:23:49:5b:82:87:1f:aa:d5:a7:8e:86:d7:7f:8a:7e

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Chains

Apr 2, 2021

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Beijing Qihu Technology Co.\, Ltd.,O=Beijing Qihu Technology Co.\, Ltd.,ST=Beijing,C=CN

Serial Number

0c:83:09:ba:16:54:68:50:e6:05:e7:5d:77:3e:56:de

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 22, 2019 - Feb 4, 2023

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:35:01:ea:17:c5:39:29:8d:be:59:1e:52:8b:f6:60

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 2, 2021 - Mar 6, 2032

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 20, 2019 - Mar 18, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

Major OS version

Entry point

620406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\544358\out\Release\QHService.pdb

kernel32

HeapAlloc GetProcessHeap HeapFree GetSystemInfo lstrcmpiW GetFileAttributesExW FreeResource GetCurrentThreadId CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess WTSGetActiveConsoleSessionId GetTickCount CreateProcessW SetFilePointer WriteFile FlushFileBuffers SetEndOfFile MapViewOfFileEx CreateFileMappingW UnmapViewOfFile GetModuleHandleA GetModuleHandleExW InterlockedIncrement CreateDirectoryW MoveFileW CopyFileW GetCommandLineW GetLongPathNameW QueueUserWorkItem GlobalFree LockFileEx UnlockFileEx InitializeCriticalSectionAndSpinCount CreateEventA GetLocalTime GetEnvironmentVariableW SetEnvironmentVariableW RaiseException GetCurrentDirectoryW GlobalLock GlobalUnlock ReleaseSemaphore CreateSemaphoreW GetDiskFreeSpaceW GlobalAlloc WideCharToMultiByte MultiByteToWideChar GetCurrentProcess SetLastError ProcessIdToSessionId lstrlenA lstrcmpiA lstrcmpA LoadLibraryA SetWaitableTimer OpenEventA GetLocaleInfoW WriteConsoleW GetConsoleOutputCP LoadLibraryExW ReleaseMutex CreateMutexW GetCurrentProcessId DeviceIoControl MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW DeleteFileW SystemTimeToFileTime GetSystemTime GetSystemDirectoryW GetSystemWindowsDirectoryW ReadFile GetFileSize WritePrivateProfileStringW GetDriveTypeW GetModuleFileNameW GetWindowsDirectoryW GetPrivateProfileStringW TerminateThread CreateThread ResetEvent GetOverlappedResult CreateFileW OpenProcess FindNextFileW FindFirstFileW ResumeThread SetEvent LoadLibraryW InterlockedCompareExchange Sleep InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError WaitForMultipleObjects WaitForSingleObject UnlockFile LockFile GetVersion FindResourceExW FindResourceW LoadResource LockResource SizeofResource LocalAlloc lstrlenW LocalFree InterlockedDecrement GetModuleHandleW GetProcAddress CloseHandle WriteConsoleA SetStdHandle QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetModuleFileNameA GetStdHandle HeapCreate VirtualAlloc VirtualFree IsValidCodePage GetOEMCP GetACP GetStringTypeW LCMapStringW LCMapStringA GetStartupInfoW ExitProcess GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitThread GetVolumeInformationW DuplicateHandle CreateSemaphoreA CancelIo DisconnectNamedPipe CreateNamedPipeW ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe TlsFree TlsAlloc HeapWalk HeapLock OpenThread HeapUnlock TlsSetValue OutputDebugStringW TlsGetValue GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime GetSystemTimeAsFileTime CreateFileA HeapSize HeapReAlloc HeapDestroy GetVersionExW CreateEventW InterlockedExchange FindClose FreeLibrary CreateWaitableTimerA

user32

CharNextW UnregisterDeviceNotification RegisterDeviceNotificationW LoadStringW GetSystemMetrics wsprintfW

advapi32

RegEnumKeyExA SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegQueryValueW RegQueryInfoKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfig2W ChangeServiceConfigW CreateServiceW SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW QueryServiceStatus StartServiceW QueryServiceConfig2W CloseServiceHandle OpenServiceW OpenSCManagerW CreateProcessAsUserW GetLengthSid SetTokenInformation DuplicateTokenEx CloseEventLog ReadEventLogW OpenEventLogW ConvertSidToStringSidW EqualSid AllocateAndInitializeSid GetTokenInformation FreeSid ConvertStringSidToSidW OpenProcessToken RegNotifyChangeKeyValue RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegEnumValueW RegEnumKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExA

shell32

ord165 ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation ord680

ole32

GetHGlobalFromStream CoUninitialize CoInitializeSecurity CoInitialize CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoTaskMemRealloc CreateStreamOnHGlobal

oleaut32

SysAllocString VarUI4FromStr SysStringByteLen SysStringLen SysAllocStringByteLen SysFreeString

shlwapi

PathFindExtensionW PathFindFileNameW SHDeleteKeyW StrCmpIW PathCombineW PathFileExistsW ord437 PathIsPrefixW PathRemoveBackslashW StrCatW StrCpyW SHGetValueA StrStrIA SHDeleteValueW SHSetValueW PathAppendW SHGetValueW PathIsDirectoryW PathRemoveFileSpecW StrStrIW SHSetValueA

winmm

timeGetTime

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

EnumProcessModules GetModuleFileNameExW

wininet

InternetOpenUrlW DeleteUrlCacheEntryW InternetOpenW InternetSetOptionW InternetCloseHandle InternetReadFile HttpQueryInfoW

wtsapi32

WTSWaitSystemEvent

userenv

ExpandEnvironmentStringsForUserW CreateEnvironmentBlock DestroyEnvironmentBlock

iphlpapi

GetAdaptersInfo

ws2_32

htons htonl ntohs ntohl

rpcrt4

RpcServerUnregisterIf RpcMgmtStopServerListening RpcServerListen RpcServerRegisterIfEx RpcServerUseProtseqEpW NdrServerCall2 NdrAsyncServerCall RpcBindingFree RpcStringFreeW RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcBindingFromStringBindingW RpcStringBindingComposeW NdrAsyncClientCall

ntdll

NtSetInformationToken RtlUnwind

Name

.text

Size

763KB

Virtual Size

763KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-02_d31f16ac5fe94ed902fd8e1085993cdc_floxif_magniber

PE Signature issue

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

winmm

version

psapi

wininet

wtsapi32

userenv

iphlpapi

ws2_32

rpcrt4

ntdll

generic