risepro | 2024-06-08_9306f6dc147c24ee1fe296de5267826e_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-08_9306f6dc147c24ee1fe296de5267826e_magniber
Size 11.4MB
Sample240608-ntmxdacb96
SHA256 50f199a3ea9a60e16073a2c73c45dc56698604ee7b2a615726bd1d91452a22ad
MD5 9306f6dc147c24ee1fe296de5267826e
SHA1 21a63eadddc94fda57c94e221dc160c621368765
SHA512 628116714bc42b643ee9a1cd8ea5c414e3145ace6353ad90a746e7f7a351b22c4741d5fe1ccb3ae0e16f8af3353264a82adf2fd341338000c40c64e5b5b73c62
SSDEEP 196608:JSCdfpiEMIFjvxB+ZEK45HdvHwgU+N+5GGX9iZZrqN12RKBG:Jd2E3jPuEHdvHwrB9irqNBs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

File Explorer

2024-06-08_9306f6dc147c24ee1fe296de5267826e_magniber

.exe 11.4MB

2024-06-08_9306f6dc147c24ee1fe296de5267826e_magniber

IMPHASH 0ca1245c6cae5297f0ff99b8732fcce7
SHA256 50f199a3ea9a60e16073a2c73c45dc56698604ee7b2a615726bd1d91452a22ad
MD5 9306f6dc147c24ee1fe296de5267826e
SHA1 21a63eadddc94fda57c94e221dc160c621368765
SHA512 628116714bc42b643ee9a1cd8ea5c414e3145ace6353ad90a746e7f7a351b22c4741d5fe1ccb3ae0e16f8af3353264a82adf2fd341338000c40c64e5b5b73c62
SSDEEP 196608:JSCdfpiEMIFjvxB+ZEK45HdvHwgU+N+5GGX9iZZrqN12RKBG:Jd2E3jPuEHdvHwrB9irqNBs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

b2:c6:a1:5e:b8:09:9c:00:38:7c:0d:18:5d:c6:7e:42:10:b1:92:9f:5d:f2:b6:36:43:72:b7:7c:e7:eb:fe:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1417258-2,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Jun 7, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

Serial Number

4f:93:62:5a:a2:02:80:13:ff:6b:e0:38:9f:e7:7f:41

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 11, 2023 - Oct 11, 2025

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6319035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\21\s\Installer\_bin\soda\Win32\SodaPDFDesktop14.pdb

msi

ord14 ord111 ord43 ord169 ord70 ord205 ord118 ord117 ord141 ord160 ord159 ord45 ord32 ord92 ord88 ord137 ord8

kernel32

GetEnvironmentVariableA GetSystemDirectoryW GetCommandLineA GetOEMCP GetACP EnumSystemLocalesW IsValidLocale GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlUnwind InitializeSListHead UnhandledExceptionFilter HeapFree InitializeCriticalSectionEx HeapSize FormatMessageW GetLastError SetEvent HeapReAlloc CloseHandle HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte FormatMessageA CreateEventA GetCurrentProcess LocalAlloc GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameW GetCommandLineW GetUserDefaultLCID GetStringTypeExW LCMapStringW LoadLibraryA FreeLibrary GetProcAddress GetModuleHandleW Sleep WaitForSingleObject RaiseException GetCurrentThreadId CreateEventW CreateThread CreateFileW ReadFile GetFileSize MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW TerminateProcess GetCurrentProcessId SetUnhandledExceptionFilter GetLogicalDriveStringsW GetStringTypeExA LCMapStringA GetFullPathNameW SetFileAttributesW DeleteFileW CopyFileW FindFirstFileW FindNextFileW FindClose SetLastError WaitForSingleObjectEx ReleaseMutex CreateMutexW ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx lstrcmpiW LoadLibraryExW CreateDirectoryW RemoveDirectoryW MoveFileExW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UpdateResourceA GlobalAlloc GlobalLock GlobalUnlock GlobalFree ProcessIdToSessionId GetModuleFileNameA LoadLibraryExA OpenProcess TlsAlloc InitializeCriticalSectionAndSpinCount WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW TlsGetValue TlsSetValue TlsFree DuplicateHandle LoadLibraryW GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetLocaleInfoW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW GetTempPathW GetSystemInfo GetSystemTimeAsFileTime GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateSemaphoreW GetNativeSystemInfo GetComputerNameW CompareStringW GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID GetStdHandle OutputDebugStringW WriteConsoleW MulDiv GetTempPathA GetTempFileNameA GlobalSize DebugBreak SetErrorMode GetModuleHandleA SetEndOfFile SetFilePointer CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile ExitProcess GetFileAttributesW GetCPInfo LocalSize lstrlenW SetHandleInformation SetFileCompletionNotificationModes CancelIo SwitchToThread RegisterWaitForSingleObject UnregisterWait SetConsoleCtrlHandler GetFileType GetConsoleMode CreateFileA FlushFileBuffers WriteFile ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeHandleStateW CancelIoEx CancelSynchronousIo GetCurrentThread QueueUserWorkItem CreateNamedPipeA ResetEvent SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW GetExitCodeProcess CreateProcessW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW SetFilePointerEx SetFileTime DeviceIoControl ReOpenFile SystemTimeToTzSpecificLocalTime GetFileInformationByHandleEx CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW GetStartupInfoW VirtualAlloc VirtualFree lstrcmpW SetThreadPriority GetThreadPriority VirtualProtect CompareStringEx LCMapStringEx EncodePointer InitOnceExecuteOnce InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetExitCodeThread GetLocaleInfoEx AreFileApisANSI SetFileInformationByHandle FindFirstFileExW GetStringTypeW TryAcquireSRWLockExclusive IsDebuggerPresent GetTickCount64 GetWindowsDirectoryW GetDiskFreeSpaceExW Module32NextW Module32FirstW K32GetModuleFileNameExW IsWow64Process MapViewOfFileEx CreateFileMappingA lstrcpynW GetFileTime GetFileAttributesExW CreateWaitableTimerA OpenEventA SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FoldStringW EnumSystemLocalesA GetLocaleInfoA IsDBCSLeadByteEx IsValidCodePage VirtualQuery ResumeThread CreateHardLinkW

winspool.drv

ord203

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

gdiplus

GdipDrawEllipse GdipDrawPie GdipDrawPath GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillRectanglesI GdipFillEllipse GdipFillPie GdipFillPath GdipDrawImageRectRect GdipSetClipRect GdipSetClipRectI GdipGetClipBoundsI GdipSaveGraphics GdipRestoreGraphics GdipBeginContainer2 GdipEndContainer GdiplusStartup GdiplusShutdown GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipGetLineSpacing GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipGetFontSize GdipCreateBitmapFromGraphics GdipCreateHBITMAPFromBitmap GdipDrawImageI GdipDrawDriverString GdipDrawArc GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipResetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDrawLine GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenMiterLimit GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath GdipClonePath GdipCreatePath GdipFree GdipAlloc GdipDrawRectangle GdipTransformPoints GdipSetPageUnit GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipDisposeImage GdipGetWorldTransform GdipCreateFromHDC

usp10

ScriptItemize ScriptFreeCache ScriptApplyDigitSubstitution ScriptBreak ScriptPlace ScriptShape

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vdate@gregorian@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vptime@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-08_9306f6dc147c24ee1fe296de5267826e_magniber

msi

kernel32

winspool.drv

userenv

gdiplus

usp10

generic