2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber

General

Target
2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber
Size 14.5MB
Sample240612-wck1fsteja
SHA256 24cdc7f0c20c323f251648e4144711d0348fa2458e94fa1784808a42376b889a
MD5 30f437644f78ba8e9e222851c182a6ef
SHA1 433f7c1988998c1105566679afb7cd98fed53b94
SHA512 93eaf92920980e41fc702e9c0d6590504ec9d67120d29c2d78f9a22591ef839e405912fda2a9fcede1044768372fa9f0f6e938a9722e0e20f7c602308305218f
SSDEEP 393216:F7qtd5N0h5SR1rxj49lOR+iGxRYe47fXicrr7:std8h5u1rxj42EPLQnr
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber

.exe 14.5MB

2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber

IMPHASH 5e3a53441951a4c4c88d673af021d564
SHA256 24cdc7f0c20c323f251648e4144711d0348fa2458e94fa1784808a42376b889a
MD5 30f437644f78ba8e9e222851c182a6ef
SHA1 433f7c1988998c1105566679afb7cd98fed53b94
SHA512 93eaf92920980e41fc702e9c0d6590504ec9d67120d29c2d78f9a22591ef839e405912fda2a9fcede1044768372fa9f0f6e938a9722e0e20f7c602308305218f
SSDEEP 393216:F7qtd5N0h5SR1rxj49lOR+iGxRYe47fXicrr7:std8h5u1rxj42EPLQnr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

16:3e:01:4b:36:25:24:04:b7:57:24:d5:47:f9:98:d9:1a:64:8e:e2:a4:87:cd:d2:60:98:66:9d:cb:04:9d:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=AVG Technologies USA\, LLC,O=AVG Technologies USA\, LLC,L=Redwood City,ST=California,C=US

Chains

May 28, 2024

CN=AVG Technologies USA\, LLC,O=AVG Technologies USA\, LLC,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

0

Major OS version

6

Entry point

264848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\SfxInst.pdb

dwmapi

DwmSetWindowAttribute

ntdll

RtlNtStatusToDosError NtClose VerSetConditionMask NtOpenKey NtQueryKey NtDeleteKey RtlUnwind

kernel32

GetSystemInfo WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle EnumSystemLocalesW IsValidLocale LCMapStringW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType ExitProcess GetStdHandle SystemTimeToFileTime TzSpecificLocalTimeToSystemTime FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList OutputDebugStringW GetProcAddress GetModuleHandleW CloseHandle SetLastError GetLastError CreateFileW DeviceIoControl WideCharToMultiByte MultiByteToWideChar FindClose FindFirstFileW RemoveDirectoryW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject SetFilePointerEx GetFileSizeEx UnmapViewOfFile ReadFile GetCurrentProcessId CreateFileMappingW MapViewOfFile OpenFileMappingW IsWow64Process GetCurrentProcess HeapAlloc GetProcessHeap GetSystemDirectoryW lstrcatW GetModuleHandleA LocalFree CreateProcessW CreateEventW ResumeThread GetExitCodeProcess GetCurrentThread FindResourceW SizeofResource LockResource LoadResource GlobalAlloc GlobalLock GlobalFree GlobalUnlock SetEvent CreateThread TerminateThread GetLocaleInfoW GetCurrentThreadId FreeLibrary FileTimeToSystemTime GetUserDefaultLangID LoadLibraryA GetCommandLineW GetFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime GetNativeSystemInfo GetPrivateProfileStringW IsProcessorFeaturePresent HeapFree GetModuleHandleExW InitializeCriticalSectionEx LCIDToLocaleName HeapSize FormatMessageW GetUserDefaultLCID HeapReAlloc DecodePointer HeapDestroy WaitForMultipleObjects WriteFile ResetEvent CompareFileTime LoadLibraryExW GetFileAttributesExW TerminateProcess VerifyVersionInfoW GetModuleFileNameW CompareStringW InitializeCriticalSectionAndSpinCount RaiseException GetTickCount QueryPerformanceFrequency QueryPerformanceCounter CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryW FlushFileBuffers DeleteFileW GetFileInformationByHandle GetFullPathNameW OutputDebugStringA TlsAlloc TlsGetValue TlsSetValue CreateSemaphoreW ReleaseSemaphore GetVersionExW ExpandEnvironmentStringsW GetShortPathNameW GetFileAttributesW GetSystemWindowsDirectoryW GetProcessAffinityMask GetLongPathNameW VirtualAlloc VirtualFree VirtualProtect GlobalMemoryStatusEx GetExitCodeThread TlsFree SetFilePointer SetFileAttributesW GetFileSize SetEndOfFile MoveFileExW GetWindowsDirectoryW LockFileEx DuplicateHandle SetFileTime CreateDirectoryW GetCurrentDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetEnvironmentVariableW GetVersion FindResourceExW SetEnvironmentVariableW WriteProcessMemory UnlockFileEx CopyFileW SetFileInformationByHandle GetDiskFreeSpaceExW VirtualQuery GetSystemTimes GetTickCount64 GetStartupInfoW IsDebuggerPresent InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExA WaitForSingleObjectEx GetStringTypeW ReleaseSRWLockExclusive

rpcrt4

RpcEpUnregister UuidFromStringW

Name

.text

Size

959KB

Virtual Size

959KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

335KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=203, id=261, version=29395,

count=1, id=263, version=29395,

count=4, id=253, version=33030,

count=20, id=260, version=33030,

count=27, id=259, version=33030,

count=111, id=261, version=33030,

count=20, id=259, version=29395,

count=26, id=260, version=29395,

count=10, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=12, productName=Unmarked objects (old),

count=4, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=13, id=257, version=29395,

count=518, id=1, productName=Unmarked objects,

count=7, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=239, id=265, version=33130,

count=1, id=256, version=33130,

count=1, id=255, version=33130,

count=2, id=151,

count=1, id=258, version=33130,

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-12_30f437644f78ba8e9e222851c182a6ef_magniber

dwmapi

ntdll

kernel32

rpcrt4

generic