2024-06-12_f96471d818cce593c995cbf2f7661bc9_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-12_f96471d818cce593c995cbf2f7661bc9_magniber
Size 4.2MB
Sample240612-2frv3atanc
SHA256 e2b32c6e4002592ae9ba8ddd1f16745a72204fef5632a444a01ddd92197bb312
MD5 f96471d818cce593c995cbf2f7661bc9
SHA1 1e232a1c19b70a774bda1ceaf3f7410df691a83d
SHA512 16c520877374f16bfb8c8d5ed2e2d690071f61a57943ecc5041e7166f78c85666630543f20df552ccd9cd98003a8c4f244d80b14c36110cd30ccb3c4f709f934
SSDEEP 98304:huXBekJVI6iC2DTpMuumjwMUskft2sEE5:4XBd2/pMulYt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-12_f96471d818cce593c995cbf2f7661bc9_magniber

File Explorer

2024-06-12_f96471d818cce593c995cbf2f7661bc9_magniber

.exe 4.2MB

2024-06-12_f96471d818cce593c995cbf2f7661bc9_magniber

IMPHASH f8077778452df96cff92fb34fe332e80
SHA256 e2b32c6e4002592ae9ba8ddd1f16745a72204fef5632a444a01ddd92197bb312
MD5 f96471d818cce593c995cbf2f7661bc9
SHA1 1e232a1c19b70a774bda1ceaf3f7410df691a83d
SHA512 16c520877374f16bfb8c8d5ed2e2d690071f61a57943ecc5041e7166f78c85666630543f20df552ccd9cd98003a8c4f244d80b14c36110cd30ccb3c4f709f934
SSDEEP 98304:huXBekJVI6iC2DTpMuumjwMUskft2sEE5:4XBd2/pMulYt
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\dbs\sh\ddvsm\0128_230433\cmd\2z\out\binaries\x86ret\bin\i386\Opt\rdajgpzw.d3y\Output\msvsmon.pdb

kernel32

FreeLibrary LoadLibraryW GetComputerNameExW GetVersionExW LoadLibraryExW LocalFree GetCurrentThreadId Sleep UnmapViewOfFile CreateEventW CreateFileMappingW MapViewOfFile GetCurrentProcessId SetEvent WaitForMultipleObjectsEx GetExitCodeProcess TerminateProcess OpenProcess MultiByteToWideChar CreateThread WaitForSingleObject GetExitCodeThread GetTempPathW GetModuleFileNameW GetFileAttributesW InterlockedExchange SwitchToThread InterlockedCompareExchange GetTickCount CreateFileW GetFileSize ReadFile FindFirstFileExW FindNextFileW FindClose HeapSetInformation SetErrorMode CreateNamedPipeW WriteFile FlushFileBuffers InitializeCriticalSectionEx DisconnectNamedPipe CancelSynchronousIo GetProcessId GetCommandLineW OpenEventW SetEnvironmentVariableW WideCharToMultiByte LocalAlloc GetDateFormatW GetTimeFormatW GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetLocalTime ExpandEnvironmentStringsW GetThreadLocale RaiseException lstrcmpiW SizeofResource LoadResource FindResourceW QueryFullProcessImageNameW GetLongPathNameW GetThreadContext GetCurrentThread SetLastError SetUnhandledExceptionFilter SetThreadPriority SuspendThread IsDebuggerPresent DecodePointer GetFileInformationByHandle DeleteCriticalSection GetProcAddress GetModuleHandleW LeaveCriticalSection EnterCriticalSection InterlockedDecrement InterlockedIncrement ResumeThread CreateProcessW ConnectNamedPipe MulDiv GetCurrentProcess GetSystemDirectoryW FindFirstFileW FormatMessageA GetComputerNameW IsWow64Process GetVersion OpenFileMappingW WriteProcessMemory VirtualAllocEx DeleteFileW WaitForMultipleObjects SetThreadAffinityMask GetProcessAffinityMask GetThreadPriority SetFilePointer RegisterWaitForSingleObject UnregisterWaitEx QueueUserWorkItem OpenThread ResetEvent GetEnvironmentVariableW InitializeCriticalSection lstrcmpW FormatMessageW GetEnvironmentVariableA VirtualAlloc VirtualFree GetVersionExA FindResourceExW LockResource FindResourceA IsDBCSLeadByte lstrcmpiA GetModuleHandleA WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA OutputDebugStringW GetStringTypeW GetFileType GetACP GetModuleHandleExW ExitProcess GetModuleFileNameA GetStdHandle TlsFree CompareStringOrdinal TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlUnwind GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo SetHandleInformation DuplicateHandle GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy CloseHandle UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList GetLastError

vsdebugeng

DkmDllEnsureInitialized DkmDllSetRootProcessId DkmDllUninitialize ProcDkmString3

gdiplus

GdiplusShutdown

user32

GetDlgItem EnableWindow CheckDlgButton GetWindowLongW SendMessageW SetWindowLongW EndDialog SetDlgItemTextW DialogBoxParamW SetDlgItemInt GetDlgItemInt SetCursor ReleaseDC GetDC CharUpperBuffW PeekMessageW PostThreadMessageW LoadStringW PeekMessageA CharNextA MessageBoxW OpenClipboard CharNextW KillTimer SetTimer TrackPopupMenu GetCursorPos SetMenuDefaultItem GetSubMenu PostMessageW PostQuitMessage CloseClipboard SetClipboardData EmptyClipboard SetFocus GetSystemMetrics SetMenu LoadMenuW DefWindowProcW MoveWindow DestroyWindow RegisterClassW LoadIconW EnableMenuItem GetMenu SetForegroundWindow DispatchMessageW TranslateMessage TranslateAcceleratorW GetMessageW LoadAcceleratorsW UpdateWindow CreateWindowExW DestroyMenu CheckRadioButton SetWindowTextW GetParent NotifyWinEvent ShowWindow LoadCursorW

oleaut32

VarUI2FromDec VarUI4FromDec VarR4FromDec VarR8FromDec VarDecAdd VarDecSu VarDecMul VarDecDiv VarDecCmp VarBstrCmp VariantCopy SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SafeArrayRedim VariantChangeType CreateErrorInfo SysAllocString VarUI1FromDec VarI1FromDec VarDecFix VarDecFromR8 VarDecFromR4 VarDecFromUI4 VarDecFromI4 GetErrorInfo VarI4FromDec VarBstrFromDec VarR8FromStr SetErrorInfo VarUI4FromStr VariantClear VarI2FromDec SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VarBstrCat VariantInit SysAllocStringLen

comctl32

ord17

ws2_32

inet_addr ntohs getsockname bind htonl closesocket setsockopt socket htons WSAStartup WSAGetLastError

gdi32

DeleteDC GetDeviceCaps SelectObject

generic

count=4, id=188, version=30716,

count=14, id=261, version=30034,

count=2, id=206, version=65500,

count=1, id=260, version=25025,

count=2, id=257, version=30146,

count=16, id=260, productName=VS2019 v16.9.5 build 29915, version=29915,

count=15, id=241, version=40116,

count=164, id=243, version=40116,

count=26, id=242, version=40116,

count=19, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,

count=24, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,

count=182, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,

count=55, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=15, id=185, version=30716,

count=527, id=1, productName=Unmarked objects,

count=1, id=259, productName=VS2019 v16.9.5 build 29915, version=29915,

count=207, id=265, version=29915,

count=1, id=256, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,

count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,