2024-06-27_99487708ebf3f81a020496be505d3ba2_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-27_99487708ebf3f81a020496be505d3ba2_magniber
Size

1.9MB
MD5

99487708ebf3f81a020496be505d3ba2
SHA1

c7ec55e32bb7869abe6b1a2173d99ca60d711d1e
SHA256

c4fc3c21e7fd935f6e4975307be6159405ee900b1a37efa60147ab703cb9793f
SHA512

aced9bc4bffa74c819f103242654cd41e8d5e8d535325a565282be3ac5841b3c1682320f6e8ee3308e12b8cd696cb2a7b382abc2205697d4b0d726e0d835343b
SSDEEP

49152:vktERlzetzBeg2L9SmFp9B5rRAu9SlPcdORi2RNiyG7y00ibS:vktERlzetzBeg2L9T9jr2ujORiC00ibS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-27_99487708ebf3f81a020496be505d3ba2_magniber

Files

2024-06-27_99487708ebf3f81a020496be505d3ba2_magniber
.exe windows:6 windows x86 arch:x86

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

AdobeIPCBroker.pdb

Imports

kernel32

GetCurrentProcess
TerminateProcess
OpenProcess
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
SetStdHandle
GetEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindNextFileW
FlushFileBuffers
GetFileSizeEx
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
GetTempPathW
DuplicateHandle
PeekNamedPipe
CreateNamedPipeW
GetNamedPipeInfo
SetEvent
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
MoveFileExW
RtlCaptureStackBackTrace
InitializeCriticalSection
DeleteCriticalSection
LCMapStringW
GetCurrentThread
FormatMessageW
LocalReAlloc
GetSystemTimeAsFileTime
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
GetSystemDirectoryA
LoadLibraryA
TryEnterCriticalSection
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsW
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeW
GetFileInformationByHandle
GetFileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
ExitProcess
GetCommandLineA
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
HeapSize
WriteConsoleW
RaiseException
GetOverlappedResult
ConnectNamedPipe
ReadFile
FindClose
DeleteFileW
GetConsoleMode
WideCharToMultiByte
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
Sleep
WriteFile
GetFileAttributesW
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
SwitchToThread
GetEnvironmentVariableW
TlsFree
GetTickCount
GetModuleFileNameW
SetDllDirectoryW
CloseHandle
GetLastError
CreateMutexW
GetCommandLineW

user32

PostQuitMessage
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DestroyWindow
SetTimer
MsgWaitForMultipleObjectsEx
DefWindowProcW
CreateWindowExW
RegisterClassW
SetWindowLongW
GetWindowLongW
GetShellWindow
EnumWindows
KillTimer
GetWindowThreadProcessId

crclient

CrashReporterInitialize

advapi32

GetUserNameW
ConvertStringSidToSidW
CreateProcessWithTokenW
LookupPrivilegeValueW
SetTokenInformation
GetTokenInformation
GetSidSubAuthority
GetLengthSid
FreeSid
EqualSid
DuplicateTokenEx
AllocateAndInitializeSid
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExW

ws2_32

htonl
ntohs
bind
closesocket
connect
ioctlsocket
getsockname
getsockopt
htons
listen
recv
select
send
socket
WSAStartup
WSAGetLastError
__WSAFDIsSet
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
WSASetLastError

Sections

.text
Size: 1005KB - Virtual size: 1005KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 628KB - Virtual size: 632KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

660b2eb72a7cb7cd1570b35441627052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

crclient

advapi32

shell32

ws2_32

Sections

.text Size: 1005KB - Virtual size: 1005KB

.rdata Size: 223KB - Virtual size: 223KB

.data Size: 38KB - Virtual size: 56KB

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 628KB - Virtual size: 632KB

.text
Size: 1005KB - Virtual size: 1005KB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 38KB - Virtual size: 56KB

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 628KB - Virtual size: 632KB