risepro | 2024-06-08_f0aaee3fb087e3234db405398448f0f4_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-08_f0aaee3fb087e3234db405398448f0f4_magniber
Size 4.6MB
Sample240608-j51v6abc89
SHA256 5253978b57e785d3ded7d2dcd0976db851295fcc4cfb2cbd8657addd19a18ad4
MD5 f0aaee3fb087e3234db405398448f0f4
SHA1 c0f10adf9a6e5aa898755d976e9672c67b8c967c
SHA512 e19e8cc87855c24fc8b36280ae5925be84fb3407fb1efc792486705e8d1c96c94da86d2a8928350d1b2f749e1f24a07156c5499ed3a7daa54cfa1baf59579710
SSDEEP 98304:48GXkWHJqMiCEeGbWNZoYAA1dxztFAWV9:48G5pqMiCHoYA0V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-08_f0aaee3fb087e3234db405398448f0f4_magniber

File Explorer

2024-06-08_f0aaee3fb087e3234db405398448f0f4_magniber

.exe 4.6MB

2024-06-08_f0aaee3fb087e3234db405398448f0f4_magniber

IMPHASH 553c24b35090144c58874b7658698293
SHA256 5253978b57e785d3ded7d2dcd0976db851295fcc4cfb2cbd8657addd19a18ad4
MD5 f0aaee3fb087e3234db405398448f0f4
SHA1 c0f10adf9a6e5aa898755d976e9672c67b8c967c
SHA512 e19e8cc87855c24fc8b36280ae5925be84fb3407fb1efc792486705e8d1c96c94da86d2a8928350d1b2f749e1f24a07156c5499ed3a7daa54cfa1baf59579710
SSDEEP 98304:48GXkWHJqMiCEeGbWNZoYAA1dxztFAWV9:48G5pqMiCHoYA0V
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2937295

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\SkullGirls.pdb

ws2_32

htonl htons WSACleanup ntohs ntohl WSAStartup

winmm

timeEndPeriod PlaySoundW timeBeginPeriod timeGetTime

dbghelp

MiniDumpWriteDump

d3d9

Direct3DCreate9

dinput8

DirectInput8Create

xinput9_1_0

XInputGetState

d3dx9_43

D3DXCreateFontW D3DXCreateTextureFromFileInMemoryEx D3DXCompileShader

tolk

Tolk_Output Tolk_HasBraille Tolk_HasSpeech Tolk_Unload Tolk_Load

steam_api

SteamAPI_UnregisterCallback SteamAPI_RegisterCallback SteamInternal_ContextInit SteamInternal_FindOrCreateUserInterface SteamAPI_GetHSteamUser SteamAPI_Init SteamAPI_UnregisterCallResult SteamAPI_RunCallbacks SteamAPI_RegisterCallResult SteamAPI_RestartAppIfNecessary SteamAPI_Shutdown SteamInternal_CreateInterface

kernel32

SetStdHandle IsValidCodePage GetACP GetTimeZoneInformation DeleteFileW HeapReAlloc GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc HeapFree GetFileType FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW FindClose TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError InterlockedPushEntrySList RtlUnwind RaiseException OutputDebugStringW CreateDirectoryW GetFileAttributesExW MoveFileExW CopyFileW CloseHandle CreateThread EnterCriticalSection ReleaseSemaphore SetThreadPriority LeaveCriticalSection InitializeCriticalSection WaitForSingleObject DeleteCriticalSection CreateSemaphoreW OutputDebugStringA GetModuleFileNameA GetLastError LoadLibraryA GetProcAddress FreeLibrary FormatMessageA Sleep LoadLibraryExW LocalFree ReadFile GetFileSizeEx GetStdHandle WriteFile GetModuleHandleExW TerminateProcess GetModuleFileNameW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount CreatePipe CreateFileW FreeEnvironmentStringsW ResumeThread GetOEMCP CreateEventW GetExitCodeThread SetEvent SetFilePointerEx CreateProcessW GetModuleHandleW WideCharToMultiByte GetEnvironmentStringsW FlushFileBuffers GetExitCodeProcess GetCurrentProcess GetCurrentThreadId CreateSemaphoreExA WaitForSingleObjectEx LoadLibraryW GetLocalTime ExitProcess GetCurrentProcessId SetThreadExecutionState IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter CreateDirectoryA InitializeCriticalSectionEx DecodePointer VirtualFree VirtualAlloc SleepConditionVariableCS WakeAllConditionVariable InitializeConditionVariable QueryPerformanceFrequency QueryPerformanceCounter GlobalAlloc GlobalLock GlobalUnlock GetUserDefaultLCID DebugBreak SetEndOfFile GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetStringTypeW SleepConditionVariableSRW GetSystemTimeAsFileTime GetTempPathW LCMapStringEx MultiByteToWideChar EncodePointer TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive HeapSize GetCommandLineA GetCommandLineW GetProcessHeap SetEnvironmentVariableW DuplicateHandle WriteConsoleW

user32

MessageBoxA OpenClipboard CloseClipboard EmptyClipboard SetClipboardData EnumDisplaySettingsExW AdjustWindowRect GetCursorPos IsIconic LoadImageW EnumDisplayDevicesW SetWindowLongW GetClientRect LoadCursorW SetCursor DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW ScreenToClient CallNextHookEx GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow RegisterDeviceNotificationW ChangeDisplaySettingsW DispatchMessageW PeekMessageW TrackMouseEvent UnhookWindowsHookEx TranslateMessage SetCapture SetWindowsHookExW PostQuitMessage EnumDisplaySettingsW SystemParametersInfoW UnregisterDeviceNotification UpdateWindow ReleaseCapture

shell32

SHGetFolderPathA SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoInitialize CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString

advapi32

CryptAcquireContextA CryptReleaseContext CryptGenRandom

iphlpapi

GetIfEntry2 GetIfTable2Ex FreeMibTable

generic

count=52, id=259, version=30795,

count=2, id=253, version=33218,

count=22, id=260, version=33218,

count=27, id=259, version=33218,

count=34, id=260, version=30795,

count=2, id=257, productName=VS2017 v15.7.1 build 26428, version=26428,

count=2, id=257, productName=VS2015 UPD1 build 23506, version=23506,

count=154, id=260, version=33523,

count=37, id=261, version=33523,

count=98, id=261, version=33218,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=2, id=156, version=21202,

count=1, id=262, version=30795,

count=229, id=261, version=30795,

count=295, id=1, productName=Unmarked objects,

count=27, id=257, version=30795,

count=319, id=265, version=33523,

count=1, id=256, version=33523,

count=1, id=255, version=33523,

count=1, id=151,

count=1, id=258, version=33523,