2024-07-27_6943f8553a4622903d4fc103fc7f428c_bugat_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-07-27_6943f8553a4622903d4fc103fc7f428c_bugat_magniber
Size

22.6MB
MD5

6943f8553a4622903d4fc103fc7f428c
SHA1

cbbd58e504e2afc976682e7439c656345145ee6b
SHA256

092eb9dcd12b79ded3658a97495c0c2a5775268850d387f2a34c3a280f59a704
SHA512

4d8c93bdce183be4b8e944acfee7afe6e8aa0c75d2ec4b673cf89e65fa7cc682e545854f5c50ab953e2baa80b5979b1c1b68ee4854e56bcbadbf8278f5b07026
SSDEEP

196608:XXhrcmyO2f7JqvwLXDXJmuslx8XfkSo2miNY04PG/QDNyeAOGnXXh1RCRXUOSC1v:XZsgIHEWE2m5tDlVGnHh1RCRFS/K

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-07-27_6943f8553a4622903d4fc103fc7f428c_bugat_magniber

Files

2024-07-27_6943f8553a4622903d4fc103fc7f428c_bugat_magniber
.exe windows:5 windows x86 arch:x86

480badf9384f16123689357e37d217fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\work\payne\build\finalpc_update\MaxPayne3.pdb

Imports

binkw32

_BinkGetError@0
_BinkDoFrameAsync@12
_BinkShouldSkip@4
_BinkNextFrame@4
_BinkDoFrame@4
_BinkGoto@12
_BinkGetKeyFrame@12
_BinkClose@4
_BinkRegisterFrameBuffers@8
_BinkGetFrameBuffersInfo@8
_BinkOpen@8
_BinkSetIOSize@4
_BinkSetSoundTrack@8
_BinkSetMemory@8
_BinkWaitStopAsyncThread@4
_BinkRequestStopAsyncThread@4
_BinkSetSoundSystem@8
_BinkDoFrameAsyncWait@8
_BinkPause@8
_BinkWait@4
_BinkSetSpeakerVolumes@20
_BinkGetRealtime@12
_BinkControlBackgroundIO@8
_BinkSetVolume@12
_BinkSetFrameRate@8
_BinkFreeGlobals@0
_BinkOpenXAudio2@4
_BinkStartAsyncThread@8

steam_api

SteamUtils
SteamUserStats
SteamAPI_UnregisterCallback
SteamApps
SteamAPI_Shutdown
SteamUser
SteamAPI_Init
SteamAPI_RegisterCallback
SteamFriends
SteamAPI_RunCallbacks

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

rpcrt4

UuidCreateSequential

dsound

ord1
ord8
ord6
ord9
ord3

psapi

GetPerformanceInfo

ws2_32

htons
ntohs
WSAGetLastError
recv
ioctlsocket
closesocket
gethostbyname
inet_addr
send
connect
socket
listen
bind
accept
getsockname
WSACleanup
WSAStartup
__WSAFDIsSet
select
setsockopt
sendto
recvfrom
ntohl
shutdown
htonl
gethostname

d3dcompiler_43

D3DReflect

imm32

ImmAssociateContext

dinput8

DirectInput8Create

kernel32

GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
RtlUnwind
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetCurrentDirectoryA
RaiseException
GetConsoleMode
GetConsoleCP
WriteConsoleW
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
CreateFileW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleExA
FreeEnvironmentStringsA
HeapSize
GetFileType
SetHandleCount
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapReAlloc
GetSystemTimeAsFileTime
GetFullPathNameA
GetDriveTypeA
GetStartupInfoA
GetModuleHandleW
InitializeSListHead
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
EnterCriticalSection
SetErrorMode
ResetEvent
GetEnvironmentStrings
GetTickCount
GetFileSizeEx
GetCommandLineA
GetModuleFileNameA
GetDiskFreeSpaceExA
GetProcAddress
FreeLibrary
LoadLibraryA
GetVersionExA
GetUserDefaultUILanguage
WideCharToMultiByte
GlobalMemoryStatusEx
GetNativeSystemInfo
GetLastError
CreateDirectoryA
SwitchToThread
InterlockedExchangeAdd
InterlockedExchange
FoldStringW
CloseHandle
SetThreadPriority
GetThreadPriority
OpenThread
GetProcessAffinityMask
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
QueryPerformanceFrequency
WaitForMultipleObjects
CreateEventA
Sleep
OpenFile
MultiByteToWideChar
VirtualAlloc
VirtualFree
HeapAlloc
GetProcessHeap
HeapFree
VirtualQueryEx
OpenProcess
GetCurrentProcessId
ExitProcess
QueryPerformanceCounter
GetCurrentThread
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
CreateMutexA
ReleaseMutex
GetSystemInfo
ResumeThread
ExitThread
GetCurrentThreadId
CreateThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
GetModuleHandleA
SetEvent
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
WriteFile
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
LocalFree
FormatMessageA
SetFilePointer
SetFilePointerEx
ReadFile
GetModuleFileNameW
SetFileTime
GetFileAttributesA
SetFileAttributesA
FindNextFileA
SetEndOfFile
MoveFileA
RemoveDirectoryA
LoadLibraryW
SetThreadExecutionState
GetVersion
OutputDebugStringA
LoadLibraryExA
CreateProcessA
GetOverlappedResult
InitializeCriticalSection

user32

SetFocus
GetClientRect
GetCursorPos
GetWindowRect
ClipCursor
ShowCursor
EnumDisplayDevicesA
MessageBoxA
DefWindowProcA
ShowWindow
UpdateWindow
CharLowerBuffA
GetForegroundWindow
CreateWindowExA
AdjustWindowRect
SetRect
ReleaseDC
GetDC
RegisterClassA
GetDesktopWindow
GetKeyboardState
GetGUIThreadInfo
GetWindowThreadProcessId
GetKeyboardType
GetKeyboardLayout
GetKeyboardLayoutNameA
LoadKeyboardLayoutA
LoadCursorA
LoadIconA
TranslateMessage
PeekMessageA
DispatchMessageA
PostMessageA
MessageBoxW
GetKeyState
SendMessageA
IsWindowUnicode
DefWindowProcW
ReleaseCapture
SetCapture
SetForegroundWindow
GetParent
GetSystemMetrics
DestroyWindow
UnregisterClassA
MapWindowPoints
SetWindowLongA
SetWindowPlacement
SetWindowPos
GetMonitorInfoA
GetWindowPlacement
GetWindowLongA
SystemParametersInfoA
ToUnicodeEx
MapVirtualKeyExA
IsWindowVisible

gdi32

DeleteDC
GetDeviceCaps
GetStockObject
ExtEscape
CreateDCA

advapi32

RegDeleteValueA
RegOpenKeyA
RegEnumKeyA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

SHGetSpecialFolderPathA
ShellExecuteA
ShellExecuteExA
SHGetFolderPathA

ole32

CoSetProxyBlanket
CoCreateInstance
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit

Sections

.text
Size: 13.6MB - Virtual size: 13.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.0MB - Virtual size: 271.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

480badf9384f16123689357e37d217fd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

binkw32

steam_api

version

winmm

rpcrt4

dsound

psapi

ws2_32

d3dcompiler_43

imm32

dinput8

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 13.6MB - Virtual size: 13.6MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 4.0MB - Virtual size: 271.1MB

.tls Size: 28KB - Virtual size: 27KB

.rsrc Size: 205KB - Virtual size: 204KB

.reloc Size: 2.7MB - Virtual size: 2.7MB

.text
Size: 13.6MB - Virtual size: 13.6MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 4.0MB - Virtual size: 271.1MB

.tls
Size: 28KB - Virtual size: 27KB

.rsrc
Size: 205KB - Virtual size: 204KB

.reloc
Size: 2.7MB - Virtual size: 2.7MB