risepro | 2024-06-09_e2942062906dfdce62959220333b827b_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-09_e2942062906dfdce62959220333b827b_magniber
Size 11.4MB
Sample240609-n2fs2aac3w
SHA256 57ee73cbabf743acbfb23ff777ae309ae317fec3b81f926fced24aec9e2b85fe
MD5 e2942062906dfdce62959220333b827b
SHA1 2db8a0ca73c926f21d1332742d69e0ae421ba517
SHA512 85a2f3178becce53c71e70a043befd96295b1450f4f47280c45a0ad1939ed33a2a88ae6698645f142fda88b0fd50c2d226e75b9590af449e1552bf7e9f3378fd
SSDEEP 196608:rSCdfpiEMIFjvxB+ZEK45HdvHwgU+N+5GGX9iZZrqNU2RKjS:rd2E3jPuEHdvHwrB9irqNEe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

risepro

Malware Config

Signatures

Risepro family
risepro

File Explorer

2024-06-09_e2942062906dfdce62959220333b827b_magniber

.exe 11.4MB

2024-06-09_e2942062906dfdce62959220333b827b_magniber

IMPHASH 0ca1245c6cae5297f0ff99b8732fcce7
SHA256 57ee73cbabf743acbfb23ff777ae309ae317fec3b81f926fced24aec9e2b85fe
MD5 e2942062906dfdce62959220333b827b
SHA1 2db8a0ca73c926f21d1332742d69e0ae421ba517
SHA512 85a2f3178becce53c71e70a043befd96295b1450f4f47280c45a0ad1939ed33a2a88ae6698645f142fda88b0fd50c2d226e75b9590af449e1552bf7e9f3378fd
SSDEEP 196608:rSCdfpiEMIFjvxB+ZEK45HdvHwgU+N+5GGX9iZZrqNU2RKjS:rd2E3jPuEHdvHwrB9irqNEe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

99:cd:a9:62:05:65:61:15:54:b8:b6:86:e4:75:91:b5:f9:6c:f1:69:b5:0b:87:fe:a6:ea:b1:62:e0:2e:a2:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1417258-2,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Jun 8, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

Serial Number

4f:93:62:5a:a2:02:80:13:ff:6b:e0:38:9f:e7:7f:41

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 11, 2023 - Oct 11, 2025

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6319035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\21\s\Installer\_bin\soda\Win32\SodaPDFDesktop14.pdb

msi

ord14 ord111 ord43 ord169 ord70 ord205 ord118 ord117 ord141 ord160 ord159 ord45 ord32 ord92 ord88 ord137 ord8

kernel32

GetEnvironmentVariableA GetSystemDirectoryW GetCommandLineA GetOEMCP GetACP EnumSystemLocalesW IsValidLocale GetConsoleOutputCP SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList RtlUnwind InitializeSListHead UnhandledExceptionFilter HeapFree InitializeCriticalSectionEx HeapSize FormatMessageW GetLastError SetEvent HeapReAlloc CloseHandle HeapAlloc DecodePointer HeapDestroy LocalFree DeleteCriticalSection GetProcessHeap WideCharToMultiByte FormatMessageA CreateEventA GetCurrentProcess LocalAlloc GetTickCount QueryPerformanceCounter QueryPerformanceFrequency GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameW GetCommandLineW GetUserDefaultLCID GetStringTypeExW LCMapStringW LoadLibraryA FreeLibrary GetProcAddress GetModuleHandleW Sleep WaitForSingleObject RaiseException GetCurrentThreadId CreateEventW CreateThread CreateFileW ReadFile GetFileSize MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW TerminateProcess GetCurrentProcessId SetUnhandledExceptionFilter GetLogicalDriveStringsW GetStringTypeExA LCMapStringA GetFullPathNameW SetFileAttributesW DeleteFileW CopyFileW FindFirstFileW FindNextFileW FindClose SetLastError WaitForSingleObjectEx ReleaseMutex CreateMutexW ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx lstrcmpiW LoadLibraryExW CreateDirectoryW RemoveDirectoryW MoveFileExW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW UpdateResourceA GlobalAlloc GlobalLock GlobalUnlock GlobalFree ProcessIdToSessionId GetModuleFileNameA LoadLibraryExA OpenProcess TlsAlloc InitializeCriticalSectionAndSpinCount WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus VerSetConditionMask VerifyVersionInfoW TlsGetValue TlsSetValue TlsFree DuplicateHandle LoadLibraryW GetSystemTime GetLocalTime FileTimeToSystemTime SystemTimeToFileTime GetTimeZoneInformation GetDateFormatW GetTimeFormatW GetLocaleInfoW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW GetTempPathW GetSystemInfo GetSystemTimeAsFileTime GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS CreateSemaphoreW GetNativeSystemInfo GetComputerNameW CompareStringW GetNumberFormatW GetCurrencyFormatW GetSystemDefaultLCID GetStdHandle OutputDebugStringW WriteConsoleW MulDiv GetTempPathA GetTempFileNameA GlobalSize DebugBreak SetErrorMode GetModuleHandleA SetEndOfFile SetFilePointer CreateFileMappingW MapViewOfFile FlushViewOfFile UnmapViewOfFile ExitProcess GetFileAttributesW GetCPInfo LocalSize lstrlenW SetHandleInformation SetFileCompletionNotificationModes CancelIo SwitchToThread RegisterWaitForSingleObject UnregisterWait SetConsoleCtrlHandler GetFileType GetConsoleMode CreateFileA FlushFileBuffers WriteFile ConnectNamedPipe SetNamedPipeHandleState PeekNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeHandleStateW CancelIoEx CancelSynchronousIo GetCurrentThread QueueUserWorkItem CreateNamedPipeA ResetEvent SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW ReadConsoleW FillConsoleOutputCharacterW FillConsoleOutputAttribute GetConsoleCursorInfo SetConsoleCursorInfo GetConsoleScreenBufferInfo SetConsoleCursorPosition SetConsoleTextAttribute WriteConsoleInputW GetExitCodeProcess CreateProcessW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetDiskFreeSpaceW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW SetFilePointerEx SetFileTime DeviceIoControl ReOpenFile SystemTimeToTzSpecificLocalTime GetFileInformationByHandleEx CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW GetStartupInfoW VirtualAlloc VirtualFree lstrcmpW SetThreadPriority GetThreadPriority VirtualProtect CompareStringEx LCMapStringEx EncodePointer InitOnceExecuteOnce InitOnceComplete InitOnceBeginInitialize IsProcessorFeaturePresent GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetExitCodeThread GetLocaleInfoEx AreFileApisANSI SetFileInformationByHandle FindFirstFileExW GetStringTypeW TryAcquireSRWLockExclusive IsDebuggerPresent GetTickCount64 GetWindowsDirectoryW GetDiskFreeSpaceExW Module32NextW Module32FirstW K32GetModuleFileNameExW IsWow64Process MapViewOfFileEx CreateFileMappingA lstrcpynW GetFileTime GetFileAttributesExW CreateWaitableTimerA OpenEventA SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock FoldStringW EnumSystemLocalesA GetLocaleInfoA IsDBCSLeadByteEx IsValidCodePage VirtualQuery ResumeThread CreateHardLinkW

winspool.drv

ord203

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

gdiplus

GdipDrawEllipse GdipDrawPie GdipDrawPath GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillRectanglesI GdipFillEllipse GdipFillPie GdipFillPath GdipDrawImageRectRect GdipSetClipRect GdipSetClipRectI GdipGetClipBoundsI GdipSaveGraphics GdipRestoreGraphics GdipBeginContainer2 GdipEndContainer GdiplusStartup GdiplusShutdown GdipDeleteFontFamily GdipGetEmHeight GdipGetCellAscent GdipGetLineSpacing GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipGetFamily GdipGetFontSize GdipCreateBitmapFromGraphics GdipCreateHBITMAPFromBitmap GdipDrawImageI GdipDrawDriverString GdipDrawArc GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipBitmapUnlockBits GdipTranslateWorldTransform GdipMultiplyWorldTransform GdipResetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetPixelOffsetMode GdipGetSmoothingMode GdipSetSmoothingMode GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDrawLine GdipCloneImage GdipSetPenDashArray GdipSetPenDashOffset GdipSetPenDashStyle GdipSetPenMiterLimit GdipSetPenLineJoin GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen2 GdipCreatePen1 GdipSetPathGradientTransform GdipSetPathGradientWrapMode GdipSetPathGradientPresetBlend GdipSetPathGradientCenterPoint GdipCreatePathGradientFromPath GdipMultiplyLineTransform GdipSetLineWrapMode GdipSetLinePresetBlend GdipCreateLineBrush GdipCreateSolidFill GdipCreateTexture GdipDeleteBrush GdipCloneBrush GdipGetMatrixElements GdipShearMatrix GdipRotateMatrix GdipScaleMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateMatrix2 GdipCreateMatrix GdipIsVisiblePathPoint GdipGetPathWorldBounds GdipAddPathRectangleI GdipAddPathArcI GdipAddPathLineI GdipAddPathEllipse GdipAddPathBezier GdipAddPathArc GdipAddPathLine GdipClosePathFigure GdipStartPathFigure GdipSetPathFillMode GdipResetPath GdipDeletePath GdipClonePath GdipCreatePath GdipFree GdipAlloc GdipDrawRectangle GdipTransformPoints GdipSetPageUnit GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHWNDICM GdipCreateFromHWND GdipDisposeImage GdipGetWorldTransform GdipCreateFromHDC

usp10

ScriptItemize ScriptFreeCache ScriptApplyDigitSubstitution ScriptBreak ScriptPlace ScriptShape

??0?$codecvt_null@_W@archive@boost@@QAE@I@Z ??0?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??0?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@IAE@XZ ??1?$codecvt_null@_W@archive@boost@@UAE@XZ ??_F?$codecvt_null@_W@archive@boost@@QAEXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EBE_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EBEHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UAppMdiData@?A0x9fec0d0d@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vdate@gregorian@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vdate@gregorian@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vptime@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vptime@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtime_duration@posix_time@boost@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AAEAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vxml_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QAE_NXZ ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@UAppMdiData@?A0x9fec0d0d@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vdate@gregorian@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vptime@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vxml_wiarchive@archive@boost@@Vtime_duration@posix_time@3@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AAEAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QAEXXZ ?unlock@singleton_module@serialization@boost@@QAEXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-09_e2942062906dfdce62959220333b827b_magniber

msi

kernel32

winspool.drv

userenv

gdiplus

usp10

generic