2024-06-06_d8c25e742f0aacd57aa0745ca1a52b87_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-06_d8c25e742f0aacd57aa0745ca1a52b87_magniber
Size 4.2MB
Sample240606-yzkpbabd71
SHA256 d057fbefb6dbbb4af77df7c81a68b889ad64e21b75afed1928a9945706e88bc0
MD5 d8c25e742f0aacd57aa0745ca1a52b87
SHA1 18c6f62c3d78383229c45ee038e91077ff70429e
SHA512 297437f632ffe6ee5d55d3d43cfbccb6016a5610f9630155ecb747be16e0b4d9c910da0074ed95bbc8b4ff2054f81c067979d869ba0d963b576d6cf1da0042f0
SSDEEP 49152:kIo080XuWKBk6ZcyjJJVSL6VlIWi7C2nDTp402U/Gn3ucfH9EMDLSjwMUskHAOhD:FuXBekJVI6iC2DTpMuumjwMUskVDv6V
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-06_d8c25e742f0aacd57aa0745ca1a52b87_magniber

File Explorer

2024-06-06_d8c25e742f0aacd57aa0745ca1a52b87_magniber

.exe 4.2MB

2024-06-06_d8c25e742f0aacd57aa0745ca1a52b87_magniber

IMPHASH f8077778452df96cff92fb34fe332e80
SHA256 d057fbefb6dbbb4af77df7c81a68b889ad64e21b75afed1928a9945706e88bc0
MD5 d8c25e742f0aacd57aa0745ca1a52b87
SHA1 18c6f62c3d78383229c45ee038e91077ff70429e
SHA512 297437f632ffe6ee5d55d3d43cfbccb6016a5610f9630155ecb747be16e0b4d9c910da0074ed95bbc8b4ff2054f81c067979d869ba0d963b576d6cf1da0042f0
SSDEEP 49152:kIo080XuWKBk6ZcyjJJVSL6VlIWi7C2nDTp402U/Gn3ucfH9EMDLSjwMUskHAOhD:FuXBekJVI6iC2DTpMuumjwMUskVDv6V
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\sh\ddvsm\0128_230433\cmd\2z\out\binaries\x86ret\bin\i386\Opt\rdajgpzw.d3y\Output\msvsmon.pdb

kernel32

FreeLibrary LoadLibraryW GetComputerNameExW GetVersionExW LoadLibraryExW LocalFree GetCurrentThreadId Sleep UnmapViewOfFile CreateEventW CreateFileMappingW MapViewOfFile GetCurrentProcessId SetEvent WaitForMultipleObjectsEx GetExitCodeProcess TerminateProcess OpenProcess MultiByteToWideChar CreateThread WaitForSingleObject GetExitCodeThread GetTempPathW GetModuleFileNameW GetFileAttributesW InterlockedExchange SwitchToThread InterlockedCompareExchange GetTickCount CreateFileW GetFileSize ReadFile FindFirstFileExW FindNextFileW FindClose HeapSetInformation SetErrorMode CreateNamedPipeW WriteFile FlushFileBuffers InitializeCriticalSectionEx DisconnectNamedPipe CancelSynchronousIo GetProcessId GetCommandLineW OpenEventW SetEnvironmentVariableW WideCharToMultiByte LocalAlloc GetDateFormatW GetTimeFormatW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetLocalTime ExpandEnvironmentStringsW GetThreadLocale RaiseException lstrcmpiW SizeofResource LoadResource FindResourceW QueryFullProcessImageNameW GetLongPathNameW GetThreadContext GetCurrentThread SetLastError SetUnhandledExceptionFilter SetThreadPriority SuspendThread IsDebuggerPresent DecodePointer GetFileInformationByHandle DeleteCriticalSection GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ResumeThread CreateProcessW ConnectNamedPipe MulDiv GetCurrentProcess GetSystemDirectoryW FindFirstFileW FormatMessageA GetComputerNameW IsWow64Process GetVersion OpenFileMappingW WriteProcessMemory VirtualAllocEx DeleteFileW WaitForMultipleObjects SetThreadAffinityMask GetProcessAffinityMask GetThreadPriority SetFilePointer RegisterWaitForSingleObject UnregisterWaitEx QueueUserWorkItem OpenThread ResetEvent GetEnvironmentVariableW InitializeCriticalSection lstrcmpW FormatMessageW GetEnvironmentVariableA VirtualAlloc VirtualFree GetVersionExA FindResourceExW LockResource FindResourceA IsDBCSLeadByte lstrcmpiA GetModuleHandleA WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA OutputDebugStringW GetStringTypeW GetFileType GetACP GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle TlsFree CompareStringOrdinal TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo SetHandleInformation DuplicateHandle GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList GetLastError

vsdebugeng

DkmDllEnsureInitialized DkmDllSetRootProcessId DkmDllUninitialize ProcDkmString3

gdiplus

GdiplusShutdown

user32

GetDlgItem EnableWindow CheckDlgButton GetWindowLongW SendMessageW SetWindowLongW EndDialog SetDlgItemTextW DialogBoxParamW SetDlgItemInt GetDlgItemInt SetCursor ReleaseDC GetDC CharUpperBuffW PeekMessageW PostThreadMessageW LoadStringW PeekMessageA CharNextA MessageBoxW OpenClipboard CharNextW KillTimer SetTimer TrackPopupMenu GetCursorPos SetMenuDefaultItem GetSubMenu PostMessageW PostQuitMessage CloseClipboard SetClipboardData EmptyClipboard SetFocus GetSystemMetrics SetMenu LoadMenuW DefWindowProcW MoveWindow DestroyWindow RegisterClassW LoadIconW EnableMenuItem GetMenu SetForegroundWindow DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW UpdateWindow CreateWindowExW DestroyMenu CheckRadioButton SetWindowTextW GetParent NotifyWinEvent ShowWindow LoadCursorW

oleaut32

VarUI2FromDec VarUI4FromDec VarR4FromDec VarR8FromDec VarDecAdd VarDecSu VarDecMul VarDecDiv VarDecCmp VarBstrCmp VariantCopy SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayRedim VariantChangeType CreateErrorInfo SysAllocString VarUI1FromDec VarI1FromDec VarDecFix VarDecFromR8 VarDecFromR4 VarDecFromUI4 VarDecFromI4 GetErrorInfo VarI4FromDec VarBstrFromDec VarR8FromStr SetErrorInfo VarUI4FromStr VariantClear VarI2FromDec SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VarBstrCat VariantInit SysAllocStringLen

comctl32

ord17

ws2_32

inet_addr ntohs getsockname bind htonl closesocket setsockopt socket htons WSAStartup WSAGetLastError

gdi32

DeleteDC GetDeviceCaps SelectObject

generic

count=4, id=188, version=30716,

count=14, id=261, version=30034,

count=2, id=206, version=65500,

count=1, id=260, version=25025,

count=2, id=257, version=30146,

count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,

count=15, id=241, version=40116,

count=164, id=243, version=40116,

count=26, id=242, version=40116,

count=19, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=24, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=182, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,

count=55, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=15, id=185, version=30716,

count=527, id=1, productName=Unmarked objects,

count=1, id=259, productName=VS2019 v16.9.5 build 29915, version=29915,

count=207, id=265, version=29915,

count=1, id=256, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,