2024-07-04_a8914d7494e80f4a1c79490173ef21b5_magniber

Sharing

Copy URL

Twitter E-mail

General

Target

2024-07-04_a8914d7494e80f4a1c79490173ef21b5_magniber
Size

1.4MB
MD5

a8914d7494e80f4a1c79490173ef21b5
SHA1

bf634991329e1a431a7436520c440ba6748ff756
SHA256

62a8e74bffd464d35c3bcb96cef3ec107528951e2ed9fac4658b097c40552cab
SHA512

b54fc91a032d28acbe625f254c9ba1329f604bb68369db70a2c6e29f95d187a59027ae68327c3e3f6972c318da175af48bcffe1b3caa0d102aaa9f3a4404fd3f
SSDEEP

24576:Xq0V2Z0GBdTSbxBIW3q2mBzpYsJgq3LXJcmN/hQEhHa5qIOdIe7/osi9gkzmV:fv3q2mBe5q5cJEhHa5qIO77/zDkk

Score

1^/10

Malware Config

Signatures

Files

2024-07-04_a8914d7494e80f4a1c79490173ef21b5_magniber
.exe windows:5 windows x86 arch:x86

d32498871714a9ea962a918c53f46e8a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

16-03-2010 00:00

Not After

15-03-2013 23:59

Subject

CN=360.cn,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=360.cn,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a1:01:4d:4c:0e:1a:37:82:ea:fe:6d:44:a5:cc:e8:58:d4:41:ad:cb
Signer

Actual PE Digest

a1:01:4d:4c:0e:1a:37:82:ea:fe:6d:44:a5:cc:e8:58:d4:41:ad:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Devtrees\trunk\客户端\newclient\Bin\pdb\Release\bbt_client.pdb

Imports

kernel32

CreateNamedPipeW
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
SetConsoleCtrlHandler
GetLocaleInfoA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
CreateThread
DisconnectNamedPipe
GetOEMCP
GetACP
ExitProcess
FatalAppExitA
HeapCreate
TlsSetValue
TlsGetValue
GetModuleFileNameA
GetStdHandle
GetModuleHandleA
GetSystemTimeAsFileTime
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoW
VirtualQuery
VirtualProtect
MoveFileA
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileAttributesA
RtlUnwind
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
ReadFile
WaitNamedPipeW
GetStringTypeA
GetOverlappedResult
ConnectNamedPipe
WaitForMultipleObjects
TerminateThread
GetTickCount
SetPriorityClass
GetCurrentThread
GlobalMemoryStatusEx
lstrcpyW
GetPrivateProfileSectionW
IsDBCSLeadByte
GetCurrentProcessId
SetFilePointer
WriteFile
GetFileSize
Sleep
lstrcatW
WinExec
LocalAlloc
OpenMutexW
GetFileAttributesW
CreateDirectoryW
GlobalReAlloc
OutputDebugStringA
GetProcessHeap
HeapAlloc
HeapFree
GetSystemInfo
CreateFileA
DeviceIoControl
GetPrivateProfileIntW
WritePrivateProfileStringW
lstrcmpiA
WriteProcessMemory
TlsAlloc
TlsFree
CreateMutexW
LoadLibraryExW
GlobalHandle
GlobalFree
RaiseException
lstrcmpiW
GetModuleHandleW
ExpandEnvironmentStringsW
LoadLibraryW
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
MulDiv
lstrcmpW
DeleteCriticalSection
InitializeCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
CreateProcessW
GetLocalTime
OutputDebugStringW
lstrcpynW
CreateEventW
SetThreadPriority
WaitForSingleObject
SetEvent
WideCharToMultiByte
lstrlenA
GetLastError
LocalFree
MultiByteToWideChar
CreateFileW
CloseHandle
GetVersionExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
SetLastError
GetCurrentThreadId
lstrlenW
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
IsValidCodePage

user32

IsRectEmpty
GetThreadDesktop
GetUserObjectInformationW
GetDoubleClickTime
EqualRect
AdjustWindowRectEx
GetMenu
GetWindowDC
GetCapture
PtInRect
IsWindowEnabled
KillTimer
WindowFromPoint
GetCursorPos
TrackPopupMenu
GetAsyncKeyState
MonitorFromPoint
DestroyMenu
AppendMenuW
CreatePopupMenu
IsCharAlphaNumericW
SetRect
GetMenuItemCount
GetMenuItemInfoW
SetMenuItemInfoW
DestroyWindow
EnumDisplayDevicesW
SetWindowLongW
GetWindowLongW
MoveWindow
GetWindowRect
GetClientRect
UpdateWindow
ShowWindow
GetParent
IsWindow
SetWindowPos
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
DrawTextW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
SetRectEmpty
GetMenuItemID
DrawStateW
CopyRect
OffsetRect
UnionRect
DrawEdge
FindWindowW
CreateDialogIndirectParamW
GetSystemMetrics
GetClassInfoExW
LoadCursorW
SendMessageW
BeginPaint
EndPaint
RegisterClassExW
CreateWindowExW
SetWindowTextW
LoadBitmapW
DestroyIcon
GetMenuItemRect
PostThreadMessageW
EnumDisplaySettingsExW
LoadImageW
CreateAcceleratorTableW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
CallWindowProcW
EndDialog
InvalidateRect
SetTimer
PostMessageW
GetActiveWindow
GetWindowTextW
GetWindowTextLengthW
ScreenToClient
IsWindowVisible
EnableWindow
GetDlgCtrlID
GetDlgItem
IsDialogMessageW
DialogBoxParamW
SetCursor
SetWindowRgn
SystemParametersInfoW
IsIconic
ShowWindowAsync
BringWindowToTop
GetMessageW
DispatchMessageW
TranslateMessage
PostQuitMessage
SetForegroundWindow
GetForegroundWindow
PeekMessageW
CreateDialogParamW
ReplyMessage
MapDialogRect
SetWindowContextHelpId
DefWindowProcW
RegisterWindowMessageW
GetSysColor
CharNextW
ClientToScreen
GetDC
UnregisterClassA
ReleaseDC
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetClassNameW
ReleaseCapture
FillRect

gdi32

RealizePalette
SetTextColor
SetBkMode
Rectangle
CreateRectRgnIndirect
CreateDIBSection
GetRgnBox
CreateRectRgn
CreateCompatibleDC
GetBkColor
GetMapMode
SetMapMode
GetViewportExtEx
SetWindowOrgEx
GetWindowExtEx
GetDIBits
LPtoDP
GetClipBox
ExtTextOutW
SetBkColor
SetViewportExtEx
SetWindowExtEx
BitBlt
SelectObject
DeleteDC
CreateCompatibleBitmap
DeleteObject
GetStockObject
GetDeviceCaps
CreateSolidBrush
GetObjectW
ExcludeClipRect
SaveDC
DPtoLP
RestoreDC
CreateFontIndirectW
CreatePen
GetCurrentObject
SetRectRgn
ExtCreateRegion
GetRegionData
SelectPalette
CombineRgn

comdlg32

ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

InitializeSecurityDescriptor
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
SetSecurityDescriptorGroup
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
FreeSid
RegQueryValueW
RegCreateKeyW
RegDeleteKeyW
SetSecurityDescriptorDacl
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyW
RegQueryValueExW
RegQueryValueExA
RegSetValueW
RegEnumKeyExW

shell32

ShellExecuteW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetPathFromIDListW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
OleDraw
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
VariantInit
SysFreeString
DispCallFunc
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen

crashreport

OnExiting
Initialize

talkdll

?Init@CTalkInterface@@QAEHXZ
??0CTalkInterface@@QAE@PAUHWND__@@@Z
SetLogInfoFuncA
??1CTalkInterface@@UAE@XZ
?Start@CTalkInterface@@QAEHPBDHH@Z
?g_dwTls@@3KA
?End@CTalkInterface@@QAEHXZ

shlwapi

PathFileExistsW
PathRemoveFileSpecW
StrStrIW
SHGetValueW

comctl32

_TrackMouseEvent
ImageList_Destroy
ImageList_GetIconSize
ImageList_Draw
ImageList_GetIcon
InitCommonControlsEx

msimg32

GradientFill

ws2_32

closesocket
listen
accept
inet_ntoa
ntohs
socket
recv
inet_addr
gethostbyname
connect
send
bind
setsockopt
shutdown
ntohl
getpeername
gethostname
WSAStartup
htonl
htons
getsockname

gdiplus

GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipSetStringFormatFlags
GdipCloneBitmapArea
GdipDrawImageRect
GdipSetWorldTransform
GdipTranslateMatrix
GdipSetMatrixElements
GdipCreateMatrix
GdipDeleteMatrix
GdipDrawLineI
GdipDrawRectangleI
GdipSetStringFormatAlign
GdipCloneBrush
GdipDrawString
GdipFillRectangle
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetPenColor
GdipCreateSolidFill
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipSetSolidFillColor
GdipDeleteBrush
GdipAlloc
GdipFree
GdipMeasureString
GdipFillPie
GdipFillRectangleI
GdipDrawArc
GdipSetSmoothingMode
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateFontFromLogfontW
GdipCreateFontFromDC
GdiplusStartup
GdiplusShutdown
GdipCloneBitmapAreaI
GdipCloneImage
GdipDrawImageRectI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipDrawRectangle

dbghelp

ImageDirectoryEntryToData

iphlpapi

GetAdaptersInfo

winmm

mixerGetNumDevs
mixerOpen
mixerGetLineControlsW
mixerGetControlDetailsW
mixerSetControlDetails
mixerGetDevCapsW
mixerGetLineInfoW
mixerClose
sndPlaySoundW
timeGetTime

wininet

InternetOpenW
HttpQueryInfoW
InternetCrackUrlW
InternetSetOptionW
HttpOpenRequestW
InternetConnectW
InternetOpenUrlW
InternetReadFile
InternetCloseHandle
HttpSendRequestW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imm32

ImmAssociateContext

Sections

.text
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 482KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d32498871714a9ea962a918c53f46e8a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

a1:01:4d:4c:0e:1a:37:82:ea:fe:6d:44:a5:cc:e8:58:d4:41:ad:cbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

crashreport

talkdll

shlwapi

comctl32

msimg32

ws2_32

gdiplus

dbghelp

iphlpapi

winmm

wininet

version

imm32

Sections

.text Size: 808KB - Virtual size: 807KB

.rdata Size: 136KB - Virtual size: 136KB

.data Size: 23KB - Virtual size: 38KB

.rsrc Size: 482KB - Virtual size: 481KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

74:f2:95:8d:31:d0:3e:b0:42:f9:08:15:55:30:52:77
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

a1:01:4d:4c:0e:1a:37:82:ea:fe:6d:44:a5:cc:e8:58:d4:41:ad:cb
Signer

.text
Size: 808KB - Virtual size: 807KB

.rdata
Size: 136KB - Virtual size: 136KB

.data
Size: 23KB - Virtual size: 38KB

.rsrc
Size: 482KB - Virtual size: 481KB