2024-06-06_9884c8cc2e44876ab8e2f54c0367b8c7_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-06_9884c8cc2e44876ab8e2f54c0367b8c7_magniber
Size

3.7MB
MD5

9884c8cc2e44876ab8e2f54c0367b8c7
SHA1

24f6f75f55fc0bd042b7adbf9b076bbc0d6fe830
SHA256

9f2d630b338bb8baba4fb5c2caa93c9f1af9a427cc37dbae5cd87f127ffef08d
SHA512

8f7641edfcf7ac3cbf5afb1bf470ed6f7f46fd1d0bab1552e6d9c2a557c14c7899a130aae37f2b5a06c66994ea5a3cf810f630a084454a38aa3c38afb4f1bcbe
SSDEEP

49152:91Ycmq3NZmfv8jp+ur5mPmRF2gGenHd/cb4mm30bCV7uUKTT8heQpwTI+8xCl8Nt:9ycdOgtR2en9/h8bV2wk+ICE

Score

1^/10

Malware Config

Signatures

Files

2024-06-06_9884c8cc2e44876ab8e2f54c0367b8c7_magniber
.exe windows:6 windows x86 arch:x86

162a41a8e26be2c8ee65791d5e430579

Code Sign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:90:c4:e4:f8:84:51:bc:88:4a:5a:d5
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

15/06/2023, 07:17

Not After

15/06/2026, 07:17

Subject

SERIALNUMBER=34051920,CN=DELTA ELECTRONICS\, INC.,O=DELTA ELECTRONICS\, INC.,STREET=No. 31-1\, Xingbang Rd.\, Shanding Vil.\, Guishan Dist.,L=Taoyuan,ST=Taoyuan,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fa:d7:d5:80:d4:92:37:73:00:0d:f0:db:54:e8:d0:b1:58:cf:d7:aa:25:21:41:64:64:76:68:41:e8:d8:b1:ee
Signer

Actual PE Digest

fa:d7:d5:80:d4:92:37:73:00:0d:f0:db:54:e8:d0:b1:58:cf:d7:aa:25:21:41:64:64:76:68:41:e8:d8:b1:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

getaddrinfo
gethostbyname
gethostbyaddr
sendto
recvfrom
inet_addr
bind
getpeername
WSAGetLastError
socket
shutdown
setsockopt
send
select
recv
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
inet_ntoa
htons
WSACleanup
WSAStartup
freeaddrinfo
gethostname

crypt32

CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptMsgGetParam
CryptMsgClose
CryptQueryObject

kernel32

GetDiskFreeSpaceA
GetTempPathA
GetLocalTime
SystemTimeToFileTime
GetACP
SetConsoleCtrlHandler
GetCurrentDirectoryA
HeapFree
TerminateProcess
GetCurrentThread
SetThreadPriority
SetPriorityClass
GetVersionExA
VirtualProtect
VirtualQuery
GetModuleFileNameA
GetModuleHandleA
SetLastError
GetSystemInfo
GetSystemDirectoryA
GetWindowsDirectoryA
GetSystemWindowsDirectoryA
GetNativeSystemInfo
GetComputerNameA
IsBadReadPtr
GetModuleHandleExA
Sleep
Process32First
Process32Next
GetTickCount64
GlobalFree
CloseHandle
OpenThread
TlsAlloc
TlsGetValue
TlsFree
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointer
WriteFile
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
FormatMessageW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetModuleHandleW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
GetWindowsDirectoryW
CreateDirectoryExW
AreFileApisANSI
MultiByteToWideChar
FreeLibrary
LoadLibraryA
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
GetCurrentThreadId
GetExitCodeProcess
CreateProcessA
GetStdHandle
DuplicateHandle
GetUserDefaultUILanguage
ExitThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
IsWow64Process
GetProfileStringA
ReadFile
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
GetCPInfo
CreateThread
FreeLibraryAndExitThread
RaiseException
GetConsoleCP
InitializeCriticalSectionAndSpinCount
TlsSetValue
LoadLibraryExW
GetDateFormatW
GetCommandLineW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
IsValidCodePage
GetOEMCP
ReadConsoleW
GetModuleFileNameW
WriteConsoleW
EncodePointer
DecodePointer
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
SetEvent
ResetEvent
CreateEventA
OpenEventA
WaitForMultipleObjects
ProcessIdToSessionId
IsBadWritePtr
OpenSemaphoreA
FlushInstructionCache
GetVersion
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetThreadContext
GetLogicalDrives
GetOverlappedResult
CreateEventW
EnumSystemFirmwareTables
GetSystemFirmwareTable
OpenMutexA
WaitForSingleObjectEx
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetExitCodeThread
SetThreadContext
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
HeapCreate
GetConsoleMode
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FindFirstFileExW
GetCommandLineA
GetTimeFormatW

user32

DispatchMessageA
wsprintfA
TranslateMessage
PeekMessageA
CallMsgFilterA
EnumDisplayDevicesA
MessageBoxA
MessageBoxW
DrawMenuBar
GetSystemMenu
AppendMenuA
LoadStringA
CharUpperBuffA
CharLowerBuffA
GetSystemMetrics

shell32

ShellExecuteExA

advapi32

GetSecurityDescriptorSacl
RegOpenKeyExA
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetUserNameA
RegCreateKeyExA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegSetValueExA
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
RegDeleteKeyA
RegFlushKey
CloseServiceHandle
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceStatus
StartServiceA
QueryServiceStatusEx
RegQueryValueExA

psapi

GetModuleFileNameExA

powrprof

PowerReadFriendlyName

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration

wintrust

WinVerifyTrust

Sections

__wibu00
Size: 681KB - Virtual size: 681KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu01
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu02
Size: 18KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 641KB - Virtual size: 640KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu03
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

__wibu04
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

__wibu05
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

__wibu06
Size: 107KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

__wibu07
Size: 116KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

162a41a8e26be2c8ee65791d5e430579

Code Sign

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

37:90:c4:e4:f8:84:51:bc:88:4a:5a:d5Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

fa:d7:d5:80:d4:92:37:73:00:0d:f0:db:54:e8:d0:b1:58:cf:d7:aa:25:21:41:64:64:76:68:41:e8:d8:b1:eeSigner

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

crypt32

kernel32

user32

shell32

advapi32

psapi

powrprof

version

winhttp

wintrust

Sections

__wibu00 Size: 681KB - Virtual size: 681KB

__wibu01 Size: 154KB - Virtual size: 154KB

__wibu02 Size: 18KB - Virtual size: 22KB

.rsrc Size: 641KB - Virtual size: 640KB

__wibu03 Size: 66KB - Virtual size: 65KB

__wibu04 Size: 2.0MB - Virtual size: 2.0MB

__wibu05 Size: 8KB - Virtual size: 12KB

__wibu06 Size: 107KB - Virtual size: 120KB

__wibu07 Size: 116KB - Virtual size: 120KB

04:00:00:00:00:01:21:58:53:08:a2
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

37:90:c4:e4:f8:84:51:bc:88:4a:5a:d5
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

fa:d7:d5:80:d4:92:37:73:00:0d:f0:db:54:e8:d0:b1:58:cf:d7:aa:25:21:41:64:64:76:68:41:e8:d8:b1:ee
Signer

__wibu00
Size: 681KB - Virtual size: 681KB

__wibu01
Size: 154KB - Virtual size: 154KB

__wibu02
Size: 18KB - Virtual size: 22KB

.rsrc
Size: 641KB - Virtual size: 640KB

__wibu03
Size: 66KB - Virtual size: 65KB

__wibu04
Size: 2.0MB - Virtual size: 2.0MB

__wibu05
Size: 8KB - Virtual size: 12KB

__wibu06
Size: 107KB - Virtual size: 120KB

__wibu07
Size: 116KB - Virtual size: 120KB