2024-08-18_85cdae6a4a4cf94f19317f397bf7a3a3_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-18_85cdae6a4a4cf94f19317f397bf7a3a3_mafia_magniber
Size

2.7MB
MD5

85cdae6a4a4cf94f19317f397bf7a3a3
SHA1

542313bc299a6c2d62bc47a583f98d9eed69e1a5
SHA256

6cb85453ebf54fb0da0ec4bc2c7df8e69e7e29e0ba8aed938131a6f183ec86d1
SHA512

0fafe6abcc2ff3dc87bac6e09e2d36b28e664c3bd37e93a3b27e8f60c067aadbc447f3d21a4c60c183f93b740349d6924665749decdf7624ba63fc99fedd1f78
SSDEEP

49152:BudM0/qtaEQrfSyYTY2CY8R8O04hv+JOIbEJrPcMpxn8WDTM/IwG4vgBWKKH:BoMCEQmyYTHCSihIgJrPcc7o/gO

Score

1^/10

Malware Config

Signatures

Files

2024-08-18_85cdae6a4a4cf94f19317f397bf7a3a3_mafia_magniber
.exe windows:5 windows x86 arch:x86

0c0ebc77d7e0ef444c912f0453053d0d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:3a:3a:6b:f8:60:14:3d:8d:4e:ca:c6:60:60:1b:dc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

02/02/2012, 00:00

Not After

15/07/2014, 23:59

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong \ ,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:82:d8:ed:c2:94:ad:e4:2c:ed:f6:c3:3b:d7:9f:28:f2:77:45:c9
Signer

Actual PE Digest

d3:82:d8:ed:c2:94:ad:e4:2c:ed:f6:c3:3b:d7:9f:28:f2:77:45:c9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Projects\MyDesk\Release\mydesk.pdb

Imports

gdiplus

GdipSetTextRenderingHint
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipDrawString
GdipCreateStringFormat
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipResetWorldTransform
GdipLoadImageFromStream
GdipLoadImageFromFile
GdipSetStringFormatFlags
GdipLoadImageFromStreamICM
GdipCreateHBITMAPFromBitmap
GdipSetStringFormatLineAlign
GdipGetPathWorldBounds
GdipGetFontStyle
GdipGetFamily
GdipDeleteFontFamily
GdipAddPathString
GdipGetFontSize
GdipSetInterpolationMode
GdipLoadImageFromFileICM
GdipCreateFontFromDC
GdipAddPathLineI
GdipSetPenDashStyle
GdipSetSmoothingMode
GdipDrawImageRectI
GdipSetImageAttributesWrapMode
GdipSetImageAttributesColorKeys
GdipSetImageAttributesColorMatrix
GdipDeletePath
GdipCreateFontFromLogfontW
GdipSaveImageToStream
GdipCreateImageAttributes
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGraphicsClear
GdipDrawImageRectRectI
GdipGetImageHeight
GdipFree
GdipAlloc
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipDisposeImage
GdipCloneImage
GdipSetPageUnit
GdipGetImageWidth
GdipCreateFromHDC
GdipCreateHICONFromBitmap
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipCreateBitmapFromHICON
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipDeleteFont
GdipMeasureString
GdipReleaseDC
GdipDeleteGraphics
GdipSaveGraphics
GdipDrawImageI
GdipRotateWorldTransform
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipGetImagePalette
GdipCreatePath
GdipGetImagePaletteSize
GdipTranslateWorldTransform
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDisposeImageAttributes
GdipAddPathArcI
GdipCloneBitmapAreaI
GdipImageRotateFlip
GdiplusStartup
GdiplusShutdown
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipGetImageThumbnail
GdipSaveImageToFile

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle
InternetWriteFile
HttpSendRequestExW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetGetConnectedState
InternetReadFile
InternetOpenUrlW
InternetSetOptionW
HttpQueryInfoW
HttpEndRequestW

powrprof

SetSuspendState
IsPwrHibernateAllowed
GetPwrCapabilities

kernel32

FindFirstFileW
lstrcpyW
FindNextFileW
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
CopyFileW
CloseHandle
WideCharToMultiByte
CreateProcessW
WriteFile
GetCurrentProcessId
CreateFileW
GetLocalTime
CreateDirectoryW
GetFullPathNameW
DeviceIoControl
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
IsBadCodePtr
IsBadReadPtr
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
WriteProcessMemory
VirtualProtect
DeleteFileW
ReadFile
GetStartupInfoW
CreatePipe
FreeResource
LocalFree
GetCommandLineW
SetUnhandledExceptionFilter
CreateMutexW
ExitProcess
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
lstrcmpiW
GetLastError
ReadProcessMemory
VirtualAllocEx
OpenProcess
GetTickCount
SetProcessWorkingSetSize
GetTempPathW
GetTempFileNameW
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDrives
GetSystemDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
LoadLibraryExA
EndUpdateResourceW
BeginUpdateResourceA
BeginUpdateResourceW
UpdateResourceW
SetFilePointer
GetFileSize
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
HeapFree
HeapAlloc
GetProcessHeap
GetVersion
MoveFileExW
TerminateThread
SetEvent
IsBadStringPtrW
MulDiv
GetUserDefaultUILanguage
lstrlenA
FindClose
WaitForSingleObject
Sleep
DeleteCriticalSection
InitializeCriticalSection
GetFileAttributesA
HeapSetInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetStdHandle
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
SetHandleCount
GetFileType
LCMapStringW
GetTimeZoneInformation
CompareStringW
CreateEventW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
SetLastError
GetCurrentThreadId
RaiseException
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
lstrlenW
LoadLibraryW
FreeLibrary
GetVersionExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FatalAppExitA
SetConsoleCtrlHandler
InterlockedExchange
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
LoadLibraryA
SetStdHandle
FlushFileBuffers
VirtualQuery
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
DosDateTimeToFileTime
SystemTimeToFileTime
SetFileTime
DuplicateHandle
GetFileInformationByHandle
GetFileSizeEx
GetSystemInfo
CreateFileA
GetLogicalDriveStringsW
GetVolumeInformationW
ExpandEnvironmentStringsW
WinExec
GetLongPathNameA
EnumResourceNamesW
GetSystemTimeAsFileTime
CreateThread
ResumeThread
ExitThread
DecodePointer
EncodePointer
RtlUnwind
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
LocalAlloc
VirtualFreeEx

user32

UnregisterHotKey
RegisterHotKey
CallNextHookEx
GetAsyncKeyState
SetWindowsHookExW
PostQuitMessage
LoadIconW
UnhookWindowsHookEx
GetWindowThreadProcessId
GetDesktopWindow
EnumWindows
GetClassNameW
CharNextW
RegisterWindowMessageW
GetWindowPlacement
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
MonitorFromPoint
DestroyMenu
RemoveMenu
GetSubMenu
TrackPopupMenu
LoadMenuW
DialogBoxParamW
ReleaseCapture
KillTimer
SetCapture
SetTimer
SetCursor
FindWindowW
CreateDialogParamW
UpdateWindow
EnableWindow
AnimateWindow
SetForegroundWindow
UpdateLayeredWindow
IsWindowVisible
CreateIconIndirect
LoadImageW
GetIconInfo
CopyRect
wsprintfW
GetCursorPos
UnionRect
DrawIconEx
DestroyIcon
IsDlgButtonChecked
CheckDlgButton
AttachThreadInput
GetActiveWindow
MessageBoxW
ShowWindow
SetWindowTextW
SetFocus
RegisterClassExW
LoadCursorW
GetClassInfoExW
CreateWindowExW
SystemParametersInfoW
PostMessageW
InvalidateRect
PtInRect
IsWindow
RedrawWindow
MoveWindow
SetWindowLongW
GetForegroundWindow
CreateAcceleratorTableW
InvalidateRgn
SetRect
CharPrevW
GetSysColor
SetCaretPos
ShowCaret
HideCaret
CreateCaret
IsIconic
IsWindowEnabled
FillRect
ReleaseDC
GetWindowDC
GetSystemMetrics
InflateRect
OffsetRect
GetClassLongW
DrawTextW
SendMessageW
GetWindowTextLengthW
GetWindowTextW
EndPaint
BeginPaint
CallWindowProcW
DefWindowProcW
EndDialog
GetDlgItem
ScreenToClient
GetParent
GetWindow
GetWindowRect
GetWindowLongW
DrawFocusRect
RegisterClassW
FindWindowExW
EnumChildWindows
GetMenu
AdjustWindowRectEx
SetPropW
GetPropW
GetUpdateRect
GetFocus
IsZoomed
SetWindowRgn
SetMenuItemBitmaps
InsertMenuW
EnableMenuItem
SetCursorPos
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
MessageBoxA
EqualRect
GetKeyState
keybd_event
UnregisterClassA
SetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
SwapMouseButton
CreateIconFromResourceEx
ModifyMenuW
AppendMenuW
CreatePopupMenu
CheckMenuItem
IntersectRect
IsRectEmpty
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
DestroyWindow
FrameRect
SetActiveWindow
SetDlgItemTextW
GetDC
GetDlgItemTextW
ClientToScreen

gdi32

SetStretchBltMode
SelectClipRgn
ExtSelectClipRgn
GetClipBox
StretchBlt
GetDIBits
PtInRegion
CreateDIBSection
LineTo
GetBitmapBits
CreatePen
Rectangle
RoundRect
GdiFlush
GetCharABCWidthsW
CreateDCW
SetDIBColorTable
CreatePatternBrush
SetBitmapBits
GetDeviceCaps
MoveToEx
OffsetRgn
SaveDC
RestoreDC
SetWindowOrgEx
CreateRoundRectRgn
GetTextMetricsW
GetTextExtentPoint32W
TextOutW
GetStockObject
CreateCompatibleBitmap
SetViewportOrgEx
CreateFontIndirectW
CreateCompatibleDC
BitBlt
GetObjectW
CombineRgn
CreateRectRgnIndirect
ExcludeClipRect
SelectObject
SetBkColor
ExtTextOutW
DeleteDC
SetTextColor
SetBkMode
DeleteObject
CreateRectRgn
CreateSolidBrush

comdlg32

GetOpenFileNameW
GetSaveFileNameW
ChooseFontW

advapi32

AdjustTokenPrivileges
RegSetValueExW
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
GetUserNameW
RegCreateKeyW
RegSetValueW
OpenProcessToken
LookupPrivilegeValueW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegFlushKey
RegOpenKeyExW

shell32

SHFileOperationW
ShellExecuteExW
SHGetMalloc
SHAppBarMessage
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetPathFromIDListW
ShellExecuteW
ord4
SHGetSpecialFolderPathW
ord2
ExtractIconW
ord727
SHQueryRecycleBinW
SHGetFileInfoW
SHGetFolderLocation
ord155
SHGetSpecialFolderLocation
SHEmptyRecycleBinW
SHGetFolderPathW
Shell_NotifyIconW
CommandLineToArgvW
SHBrowseForFolderW

ole32

OleInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoSetProxyBlanket
RegisterDragDrop
RevokeDragDrop
OleUninitialize
OleDuplicateData
ReleaseStgMedium
OleSetContainedObject
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
StgCreateDocfile
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
OleCreateStaticFromData

oleaut32

SysAllocStringLen
VarUI4FromStr
VariantClear
VariantInit
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString

shlwapi

PathFindFileNameW
PathAppendW
StrCpyW
PathFileExistsW
PathFindExtensionW
PathFileExistsA

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx
ImageList_DragLeave
ImageList_EndDrag
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_BeginDrag
ImageList_DragEnter
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Create

msi

ord217
ord173

dbghelp

MiniDumpWriteDump

iphlpapi

GetAdaptersInfo

imagehlp

CheckSumMappedFile

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 430KB - Virtual size: 430KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0c0ebc77d7e0ef444c912f0453053d0d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

76:3a:3a:6b:f8:60:14:3d:8d:4e:ca:c6:60:60:1b:dcCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

d3:82:d8:ed:c2:94:ad:e4:2c:ed:f6:c3:3b:d7:9f:28:f2:77:45:c9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdiplus

version

urlmon

wininet

powrprof

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msi

dbghelp

iphlpapi

imagehlp

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 430KB - Virtual size: 430KB

.data Size: 27KB - Virtual size: 47KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 487KB - Virtual size: 487KB

.reloc Size: 83KB - Virtual size: 83KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

76:3a:3a:6b:f8:60:14:3d:8d:4e:ca:c6:60:60:1b:dc
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d3:82:d8:ed:c2:94:ad:e4:2c:ed:f6:c3:3b:d7:9f:28:f2:77:45:c9
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 430KB - Virtual size: 430KB

.data
Size: 27KB - Virtual size: 47KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 487KB - Virtual size: 487KB

.reloc
Size: 83KB - Virtual size: 83KB