2024-08-18_97b4928641eacd0fa06791826804c8ba_mafia_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-18_97b4928641eacd0fa06791826804c8ba_mafia_magniber
Size

1.0MB
MD5

97b4928641eacd0fa06791826804c8ba
SHA1

6fcd568820bc2c68627f386027665a307a0f5210
SHA256

f22b80d6a39fc426ee751f3aeb1f36a461d01057d238c311bf16be7e02e59b34
SHA512

6f377486a68cc782aa5fc0c281820b58f86830376d43d90ea27c943b1f1d63bc38e18d4e0a138a415fa5fecfc6a5f50e8724b7a957748c868eedbc03734e4dba
SSDEEP

24576:IwuFyX2/R1L7H0u8k4AW47KKzRzNu5w7zvFKtd6Tb+Tc:IM2ZJX8H47KqzNu5wqd6TX

Score

1^/10

Malware Config

Signatures

Files

2024-08-18_97b4928641eacd0fa06791826804c8ba_mafia_magniber
.exe windows:5 windows x86 arch:x86

338aac16b3ce03f4b736145381c08566

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:e6:ae:54:01:19:e6:36:5b:fe:8c:42:d1:b0:3c:d9
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/10/2018, 00:00

Not After

07/10/2021, 23:59

Subject

SERIALNUMBER=110111-1707178,CN=NAVER Corp.,O=NAVER Corp.,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085375776f6e2d5369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

8e:aa:c8:91:0a:ea:a8:4f:3e:e3:d7:34:d1:2d:96:42:fe:06:ea:e0
Signer

Actual PE Digest

8e:aa:c8:91:0a:ea:a8:4f:3e:e3:d7:34:d1:2d:96:42:fe:06:ea:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Program Files (x86)\Jenkins\workspace\toolbar_x86\pdb\NaverTBHelper.pdb

Imports

kernel32

FreeResource
FindClose
CopyFileW
GetTempFileNameW
GetShortPathNameA
LoadLibraryW
GetFullPathNameW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
OpenMutexW
WaitForSingleObject
WriteFile
SetFilePointer
CreateFileW
GetCurrentProcessId
GlobalSize
SetFileTime
GetCurrentDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ReadFile
QueryPerformanceCounter
GetFileType
SetHandleCount
CreateThread
FreeEnvironmentStringsW
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
GetStringTypeW
GetLocaleInfoW
GetStdHandle
LCMapStringW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
ExitProcess
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
RtlUnwind
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
CreateToolhelp32Snapshot
Process32First
Process32Next
GetSystemTime
LocalAlloc
GetTimeZoneInformation
CreateMutexW
ReleaseMutex
OpenProcess
TerminateProcess
GetExitCodeProcess
VerSetConditionMask
VerifyVersionInfoW
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
lstrcpynW
lstrcpynA
GetVersionExW
LoadLibraryExW
FreeLibrary
lstrcmpiW
lstrlenA
MultiByteToWideChar
GetModuleHandleW
GetProcAddress
CreateDirectoryW
DeleteFileW
GetTempPathW
OutputDebugStringW
Sleep
CloseHandle
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
LocalFree
GetCommandLineW
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
MulDiv
lstrcmpW
SetLastError
GetCurrentProcess
FlushInstructionCache
lstrlenW
lstrcpyW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetEnvironmentStringsW

user32

DestroyMenu
MessageBeep
TrackPopupMenuEx
SetCursor
IsWindowEnabled
GetDlgCtrlID
GetCapture
DrawFocusRect
DrawEdge
GetMenu
UpdateWindow
SystemParametersInfoW
UnregisterClassA
CallNextHookEx
UnhookWindowsHookEx
MoveWindow
GetWindowRect
GetDesktopWindow
MessageBoxW
SetWindowsHookExW
GetForegroundWindow
CreatePopupMenu
SetWindowRgn
GetClientRect
PostMessageW
FindWindowW
SendMessageW
InflateRect
GetSystemMetrics
GetWindowDC
BringWindowToTop
SetClassLongW
GetClassLongW
CharUpperBuffW
GetKeyState
MonitorFromWindow
MonitorFromRect
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
DrawIconEx
GetIconInfo
DrawTextW
AppendMenuW
GetMenuItemCount
RemoveMenu
GetMonitorInfoW
MonitorFromPoint
PostQuitMessage
IsWindow
LoadStringA
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
MapWindowPoints
LoadStringW
LoadMenuW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
IsIconic
SetWindowPos
ShowWindow
IsChild
GetClassInfoExW
LoadCursorW
GetParent
DefWindowProcW
RegisterClassExW
GetSysColor
CharNextW
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
GetDlgItem
GetClassNameW
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
DestroyAcceleratorTable
GetWindow
GetFocus
SetFocus
LoadAcceleratorsW
LoadImageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
wvsprintfW
SetPropW
TranslateAcceleratorW
KillTimer
SetTimer
AdjustWindowRectEx
LoadIconW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
PtInRect
FindWindowExW
CreateAcceleratorTableW

gdi32

CreateRectRgnIndirect
GetClipBox
StretchBlt
ExtSelectClipRgn
RectVisible
StretchDIBits
CreateFontIndirectW
SetStretchBltMode
SetDIBitsToDevice
RealizePalette
GetDIBits
CreateDIBSection
CreateDIBitmap
CreateBitmapIndirect
TextOutW
SetTextColor
GetStockObject
DeleteObject
CombineRgn
CreateRectRgn
SelectObject
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetDeviceCaps
CreateSolidBrush
ExtTextOutW
SetBkColor
SetViewportOrgEx
CreateBitmap
GetObjectW
SetBkMode

advapi32

GetTokenInformation
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
GetUserNameW
RegEnumKeyW
GetSidSubAuthorityCount
GetSidSubAuthority
AllocateAndInitializeSid
OpenProcessToken
RegOpenKeyExW
EqualSid
FreeSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetMalloc
SHGetDesktopFolder
ShellExecuteW
ShellExecuteExW
CommandLineToArgvW

ole32

CoGetClassObject
OleLockRunning
StringFromGUID2
OleRun
CoCreateGuid
StringFromCLSID
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID

oleaut32

CreateErrorInfo
SysStringByteLen
SysAllocStringByteLen
VariantCopy
VarBstrCmp
DispCallFunc
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantInit
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
SysStringLen
GetErrorInfo
VariantChangeType
SetErrorInfo

shlwapi

StrCmpNW
StrRetToStrW
StrChrW
PathAppendW
PathFileExistsW
PathCombineW
PathFindFileNameW

comctl32

ImageList_Destroy
_TrackMouseEvent
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Draw

wininet

DeleteUrlCacheEntryW
InternetSetCookieW
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetGetCookieExW
InternetOpenUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW
InternetAttemptConnect
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetQueryDataAvailable
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
InternetSetOptionW
InternetOpenA

urlmon

URLDownloadToCacheFileW
ObtainUserAgentString
URLDownloadToFileW

winmm

PlaySoundA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

imm32

ImmReleaseContext
ImmSetCompositionStringW
ImmGetConversionStatus
ImmGetContext
ImmSetConversionStatus

Sections

.text
Size: 762KB - Virtual size: 762KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

338aac16b3ce03f4b736145381c08566

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

7a:e6:ae:54:01:19:e6:36:5b:fe:8c:42:d1:b0:3c:d9Certificate

Extended Key Usages

Key Usages

8e:aa:c8:91:0a:ea:a8:4f:3e:e3:d7:34:d1:2d:96:42:fe:06:ea:e0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

wininet

urlmon

winmm

version

imm32

Sections

.text Size: 762KB - Virtual size: 762KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 14KB - Virtual size: 23KB

.rsrc Size: 83KB - Virtual size: 83KB

.reloc Size: 28KB - Virtual size: 27KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

7a:e6:ae:54:01:19:e6:36:5b:fe:8c:42:d1:b0:3c:d9
Certificate

8e:aa:c8:91:0a:ea:a8:4f:3e:e3:d7:34:d1:2d:96:42:fe:06:ea:e0
Signer

.text
Size: 762KB - Virtual size: 762KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 14KB - Virtual size: 23KB

.rsrc
Size: 83KB - Virtual size: 83KB

.reloc
Size: 28KB - Virtual size: 27KB