2024-08-17_88a1ceada9dd5e6d9516914da23237aa_hijackloader_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-17_88a1ceada9dd5e6d9516914da23237aa_hijackloader_magniber_revil
Size

43.5MB
MD5

88a1ceada9dd5e6d9516914da23237aa
SHA1

0f576f1187b13461fab85f96a0a0714a3b8db725
SHA256

dfd17318899f8522bdcab1bc9c6fe09e7d8cc76023028cf9bc58cce5ce6ca27e
SHA512

03601f1dd0678710cd94ef47c5b8c8164441e8212ff4c5aebd3219b14c0feea94ff288aa0f7c9b66e428457daaffba9e313e4f78c7123839117a2942c0bbb59d
SSDEEP

786432:IdjGVRI2gs8LmhnpadgV9ISdZB6Vay4bcXH7QBwK/c+uxUZ3Qplg:7uxSpVef/4IXbwXGxU5Kg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-17_88a1ceada9dd5e6d9516914da23237aa_hijackloader_magniber_revil

Files

2024-08-17_88a1ceada9dd5e6d9516914da23237aa_hijackloader_magniber_revil
.exe windows:6 windows x86 arch:x86

00ed9e117a9fc4c50ac0c54e089f8a03

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Jenkins\jobs\LenovoStore\workspace\bin\x86\Release_Inst\StoreInstaller.pdb

Imports

ws2_32

WSAStartup
gethostname
gethostbyname

kernel32

GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
HeapCreate
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
TryEnterCriticalSection
AreFileApisANSI
GetSystemFirmwareTable
FlushFileBuffers
FlushViewOfFile
VirtualProtect
LoadLibraryExA
IsDebuggerPresent
GetStringTypeW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
DuplicateHandle
GetCurrentThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetModuleHandleExW
GetFileType
SetConsoleCtrlHandler
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
SetStdHandle
SizeofResource
HeapFree
InitializeCriticalSectionEx
FindFirstFileExW
IsValidCodePage
HeapSize
GetLastError
LockResource
DeleteFileW
HeapReAlloc
RaiseException
FindResourceExW
LoadResource
FindResourceW
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
FindFirstFileW
FindNextFileW
ExpandEnvironmentStringsW
FindClose
GetModuleHandleW
FreeLibrary
CreateDirectoryW
WriteFile
CreateFileW
FreeResource
Sleep
CloseHandle
LoadLibraryW
GetFileAttributesExW
LoadLibraryExW
OutputDebugStringW
ProcessIdToSessionId
CreateFileA
lstrlenA
GetFullPathNameW
GetSystemTime
GlobalMemoryStatusEx
GetPrivateProfileStringW
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSection
VirtualQuery
GetSystemTimeAsFileTime
GetSystemInfo
GetNativeSystemInfo
GlobalFree
GetVersionExW
LocalAlloc
VirtualAlloc
VirtualFree
GetStartupInfoW
GetFileTime
DosDateTimeToFileTime
CreateDirectoryA
CopyFileW
MoveFileExW
GetWindowsDirectoryW
FileTimeToLocalFileTime
FileTimeToSystemTime
SetFileAttributesW
GetSystemDirectoryW
GetEnvironmentVariableW
RemoveDirectoryW
MoveFileW
ReleaseMutex
GetPrivateProfileIntW
GetStdHandle
SetConsoleTextAttribute
GetFileSizeEx
LeaveCriticalSection
EnterCriticalSection
CreateThread
SetEvent
lstrcpynW
GlobalAlloc
InitializeCriticalSectionAndSpinCount
FormatMessageW
LocalFree
SystemTimeToFileTime
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetFileAttributesW
ExitProcess
GetACP
WideCharToMultiByte
GlobalUnlock
GetModuleFileNameW
GlobalLock
GetTickCount
ReadFile
GetFileSize
GetCurrentDirectoryW
VerifyVersionInfoW
MulDiv
VerSetConditionMask
CreateMutexW
GetExitCodeProcess
lstrcmpiW
lstrcpyW
CreateProcessW
GetCurrentProcessId
GetProcAddress
Process32FirstW
Process32NextW
Wow64RevertWow64FsRedirection
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
Wow64DisableWow64FsRedirection
lstrlenW
GetCurrentProcess
GetDiskFreeSpaceExW
GetTickCount64
MultiByteToWideChar
CreateEventW
ResumeThread
GetCurrentThreadId
WaitForSingleObject
SetThreadPriority
GetLocalTime
GetTempPathW

user32

MapVirtualKeyExW
GetDesktopWindow
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
AppendMenuW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
UpdateWindow
EqualRect
GetKeyNameTextW
DrawTextA
GetWindowTextW
GetWindowTextLengthW
wsprintfA
PostQuitMessage
EnableMenuItem
DestroyMenu
CreatePopupMenu
SetRect
KillTimer
GetClientRect
SetTimer
SendMessageW
SetWindowTextW
GetKeyboardLayout
MessageBoxW
SetWindowPos
GetWindowRect
FindWindowW
PostMessageW
IsIconic
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
IsWindow
TrackPopupMenu
SetProcessDPIAware
FillRect
DrawTextW
CharPrevW
ShowWindow
GetWindowRgn
IsWindowEnabled
MoveWindow
UpdateLayeredWindow
SetWindowRgn
GetPropW
SetPropW
GetSystemMetrics
EnableWindow
GetClassInfoExW
RegisterClassExW
RegisterClassW
CallWindowProcW
DefWindowProcW
wsprintfW
InflateRect
LoadCursorW
SetCursor
GetMonitorInfoW
MonitorFromWindow
LoadImageW
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
PtInRect
IsRectEmpty
OffsetRect
UnionRect
IntersectRect
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseCapture
SetCapture
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
IsZoomed
IsWindowVisible
DestroyWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
MonitorFromPoint
ReleaseDC
GetDC
GetWindowThreadProcessId

gdi32

SetBitmapBits
GetBitmapBits
GetTextExtentPointA
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps

advapi32

RegOpenKeyExA
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
OpenServiceW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
RegFlushKey
RegSetValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
QueryServiceStatus
CloseServiceHandle
RegQueryValueExA
OpenSCManagerW
AllocateAndInitializeSid
ControlService
OpenProcessToken
FreeSid
StartServiceW
CheckTokenMembership

shell32

SHFileOperationW
SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
CommandLineToArgvW
DragQueryFileW
SHGetMalloc

ole32

OleLockRunning
CoCreateInstance
CoInitialize
CoUninitialize
CoCreateGuid
CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

crypt32

CertFindCertificateInStore
CertGetNameStringW
CertGetCertificateContextProperty
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose

shlwapi

PathRemoveFileSpecW
StrCpyNW
PathIsDirectoryA
PathFindFileNameW
PathAppendW
PathFileExistsW
PathIsDirectoryW
PathFindExtensionW

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

wininet

HttpAddRequestHeadersW
InternetSetOptionW
InternetQueryDataAvailable
InternetQueryOptionW
HttpSendRequestW
HttpOpenRequestW
InternetWriteFile
InternetOpenW
HttpQueryInfoW
InternetAttemptConnect
InternetGetConnectedStateExW
HttpEndRequestW
InternetConnectW
InternetCloseHandle
HttpSendRequestExW
InternetReadFile

rpcrt4

UuidToStringA
RpcStringFreeA

comctl32

InitCommonControlsEx
_TrackMouseEvent
ord17

gdiplus

GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipDrawImageI
GdipDrawLine
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipSetPenEndCap
GdipSetPenStartCap
GdipCreatePen2
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectRect
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipResetWorldTransform
GdipSetWorldTransform
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetSmoothingMode
GdipReleaseDC
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipRotateMatrix
GdipTranslateMatrix
GdipDeleteMatrix
GdipCreateMatrix
GdipAddPathArc
GdipAddPathLine

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

version

GetFileVersionInfoSizeExW
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoExW

dxgi

CreateDXGIFactory1

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhAddCounterW
PdhOpenQueryW

wintrust

CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 382KB - Virtual size: 382KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 142.9MB - Virtual size: 142.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

00ed9e117a9fc4c50ac0c54e089f8a03

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crypt32

shlwapi

wtsapi32

wininet

rpcrt4

comctl32

gdiplus

imm32

version

dxgi

iphlpapi

pdh

wintrust

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 382KB - Virtual size: 382KB

.data Size: 25KB - Virtual size: 43KB

.tls Size: 512B - Virtual size: 21B

.gfids Size: 3KB - Virtual size: 3KB

.rsrc Size: 142.9MB - Virtual size: 142.9MB

.reloc Size: 93KB - Virtual size: 92KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 382KB - Virtual size: 382KB

.data
Size: 25KB - Virtual size: 43KB

.tls
Size: 512B - Virtual size: 21B

.gfids
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 142.9MB - Virtual size: 142.9MB

.reloc
Size: 93KB - Virtual size: 92KB