2024-06-14_0eaf1848404fad4b2c338d704e0b0e7a_magniber

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-14_0eaf1848404fad4b2c338d704e0b0e7a_magniber
Size 1.3MB
Sample240614-ldd87ayapp
SHA256 011ed5e515af1f070a9b0baf622412f93465b5ae5a06ef89bf5a84ff68c41957
MD5 0eaf1848404fad4b2c338d704e0b0e7a
SHA1 ba82f0fe3a9a8e9fece1f63663127147a10238bb
SHA512 9f3ab16cb2417c443817a1b3fd97ed1620d602d9945a855999c1ef7b2dc614dc2731a21c6f1510d9fe8d15dd86ab7371bd61a607107d6b9dcc215571bb97ac92
SSDEEP 24576:Hcyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4ZP4NDa:HhOrzE6ooooECK1GJdO+eiP1SOe4mNDa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-14_0eaf1848404fad4b2c338d704e0b0e7a_magniber

File Explorer

2024-06-14_0eaf1848404fad4b2c338d704e0b0e7a_magniber

.exe 1.3MB

2024-06-14_0eaf1848404fad4b2c338d704e0b0e7a_magniber

IMPHASH 46c8dee621ff737948aafe8f34fa5716
SHA256 011ed5e515af1f070a9b0baf622412f93465b5ae5a06ef89bf5a84ff68c41957
MD5 0eaf1848404fad4b2c338d704e0b0e7a
SHA1 ba82f0fe3a9a8e9fece1f63663127147a10238bb
SHA512 9f3ab16cb2417c443817a1b3fd97ed1620d602d9945a855999c1ef7b2dc614dc2731a21c6f1510d9fe8d15dd86ab7371bd61a607107d6b9dcc215571bb97ac92
SSDEEP 24576:Hcyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4ZP4NDa:HhOrzE6ooooECK1GJdO+eiP1SOe4mNDa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

308816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb

shell32

SHGetFolderPathW

ntdll

RtlNtStatusToDosError VerSetConditionMask RtlUnwind

kernel32

CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW GetPriorityClass GetProcessTimes K32GetProcessMemoryInfo CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetVersionExW QueryPerformanceCounter ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetWindowsDirectoryW GetSystemDirectoryW DeviceIoControl VirtualAlloc VirtualFree VirtualProtect HeapDestroy HeapReAlloc GlobalMemoryStatusEx WaitForMultipleObjects TerminateThread GetExitCodeThread TlsFree SetFilePointer SetEndOfFile MoveFileExW LockFileEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW RemoveDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetEnvironmentVariableW WriteConsoleW K32GetMappedFileNameW CopyFileW SetFileInformationByHandle GetFileSizeEx GetDiskFreeSpaceExW FindResourceW LoadResource LockResource SizeofResource GetVolumePathNameW GetVolumeNameForVolumeMountPointW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes SetFilePointerEx GetTickCount64 RaiseException GetConsoleOutputCP GetStdHandle GetCommandLineA GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList OutputDebugStringW K32GetProcessImageFileNameW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList FreeLibrary LocalFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId ReadConsoleW GetSystemTimeAsFileTime FileTimeToSystemTime OutputDebugStringA GetFullPathNameW ReadFile GetFileInformationByHandle DeleteFileW LeaveCriticalSection EnterCriticalSection FlushFileBuffers GetLastError WriteFile CreateFileW SetLastError Sleep DeleteCriticalSection InitializeCriticalSection CompareStringW GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc GetCurrentThreadId GetModuleHandleExW HeapFree GetUserDefaultUILanguage GetCommandLineW GetCurrentProcess InitializeCriticalSectionEx WideCharToMultiByte MultiByteToWideChar CloseHandle GetConsoleMode LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetFileAttributesW UnlockFileEx FindResourceExW HeapSize GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateThread GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapSetInformation IsProcessorFeaturePresent ExitProcess lstrcpyW SetDllDirectoryW GlobalFree GetTimeZoneInformation LoadLibraryW GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx LCMapStringEx EncodePointer DecodePointer GetCPInfo

user32

MessageBoxW PostMessageW GetSystemMetrics CharLowerW SetWindowLongW GetWindowLongW DefWindowProcW SystemParametersInfoW LoadImageW CreateWindowExW SendMessageW SetWindowPos SetFocus DestroyWindow PostQuitMessage DestroyIcon GetDC ReleaseDC GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW LoadIconW EndPaint BeginPaint InvalidateRect UpdateWindow RegisterWindowMessageW KillTimer DrawTextW SetTimer MoveWindow LoadCursorW IsWindow ShowWindow SetWindowTextW UnregisterClassW GetClassInfoExW RegisterClassExW

advapi32

GetTokenInformation IsValidSid GetSidSubAuthority GetSidSubAuthorityCount DuplicateTokenEx CryptReleaseContext CryptGenRandom CryptAcquireContextW RegCloseKey RegQueryValueExW RegOpenKeyExW LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW OpenProcessToken

comctl32

ord17

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromStream GdipGetPropertyItemSize GdipDeleteGraphics GdipImageGetFrameCount GdipCreateFromHDC GdipImageGetFrameDimensionsList GdiplusStartup GdiplusShutdown GdipImageGetFrameDimensionsCount GdipCloneImage GdipImageSelectActiveFrame GdipFree GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipGetPropertyItem

shlwapi

PathMatchSpecW

gdi32

SelectObject DeleteObject GetTextExtentPoint32W SetBkMode SetTextColor DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontIndirectW

ole32

CoCreateInstance CreateStreamOnHGlobal

Name

.text

Size

909KB

Virtual Size

909KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=259, version=29395,

count=190, id=261, version=29395,

count=2, id=253, version=31823,

count=19, id=260, version=31823,

count=24, id=259, version=31823,

count=97, id=261, version=31823,

count=25, id=260, version=29395,

count=5, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=30146,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, productName=Unmarked objects (old),

count=1, id=263, version=29395,

count=19, id=257, version=29395,

count=430, id=1, productName=Unmarked objects,

count=146, id=265, version=31937,

count=1, id=256, version=31937,

count=1, id=255, version=31937,

count=3, id=151,

count=1, id=258, version=31937,