2024-09-03_f2751af4843b750a3bda1da2d618036f_magniber

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-03_f2751af4843b750a3bda1da2d618036f_magniber
Size

864KB
MD5

f2751af4843b750a3bda1da2d618036f
SHA1

7852d10d149fa23673c67be387d1afdb88ed198f
SHA256

01ed3f5484d62a0a8a5d0cc149815b594b4226b9447c7a9bb34d65c59a1bb500
SHA512

3e1431758c33de87738d3b1c680f2e2e15d6cda774f9b4a58f6b0b8e24878546e8a7ce41dd5289a9d540fb0031c31ee8ace59cb6d8c7182c6e44079f143a7552
SSDEEP

24576:YCJqpYXw9OIBnoHqJBLQHuYPobHVALYyqmu:eph2qzUHuYy6LZqmu

Score

1^/10

Malware Config

Signatures

Files

2024-09-03_f2751af4843b750a3bda1da2d618036f_magniber
.exe windows:5 windows x86 arch:x86

4164ab9ece7707caabc622d8b4314507

Code Sign

31:d8:93:ab:c8:84:26:e7:b3:82:e0:3e:50:08:10:33
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

11/06/2015, 07:44

Not After

11/06/2016, 08:14

Subject

CN=合肥玺智电子商务有限公司,O=合肥玺智电子商务有限公司,L=合肥市,ST=安徽省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

19:c2:85:30:e9:3b:36
Certificate

Issuer

CN=StartCom Certification Authority,OU=Secure Digital Certificate Signing,O=StartCom Ltd.,C=IL

Not Before

17/09/2006, 22:46

Not After

31/12/2019, 23:59

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:eb:23:d1:3d:30:ec:16:b8:bf:7a:a8:d4:2e:ab:6c:5e:59:6a:46
Signer

Actual PE Digest

58:eb:23:d1:3d:30:ec:16:b8:bf:7a:a8:d4:2e:ab:6c:5e:59:6a:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
lstrcmpW
GetPrivateProfileStringW
GetCommandLineW
lstrcatW
CreateMutexW
GetLastError
FindResourceA
SizeofResource
LoadResource
FreeResource
ReadFile
SetEndOfFile
GetTempPathA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateProcessA
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
SetFilePointerEx
GetConsoleMode
lstrcpyW
OutputDebugStringW
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetFileType
GetCPInfo
GetOEMCP
lstrlenW
Sleep
GetModuleHandleW
GetProcAddress
GetTickCount
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
WaitForSingleObject
GetACP
IsValidCodePage
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapSize
GetStringTypeW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetConsoleCP
CreateProcessW
SetLastError
GetProcessHeap
WriteFile
GetStdHandle
IsProcessorFeaturePresent
IsDebuggerPresent
RtlUnwind
RaiseException
HeapFree
LoadLibraryExW
GetCurrentThreadId
AreFileApisANSI
GetModuleHandleExW
ExitProcess
ReadConsoleW
DecodePointer
EncodePointer
ResumeThread
ExitThread
CreateThread
HeapAlloc
LocalFree

user32

LoadCursorW
DefWindowProcW
PostQuitMessage
SetTimer
KillTimer
GetClassNameW
GetWindowThreadProcessId
GetSystemMetrics
IsWindow
ShowWindow
GetMessageW
RegisterClassExW
TranslateMessage
DispatchMessageW
GetWindowLongW
FindWindowW
BeginPaint
GetShellWindow
WindowFromPoint
GetWindowRect
LoadIconW
SendMessageW
CreateWindowExW
SetWindowLongW
SetWindowPos
EndPaint
UpdateWindow
GetDesktopWindow
LoadStringW
LoadAcceleratorsW
TranslateAcceleratorW
MessageBoxW

shell32

Shell_NotifyIconW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

OleUninitialize
OleInitialize
StringFromCLSID
CoTaskMemFree

oleaut32

VariantClear
SysAllocString

shlwapi

PathFileExistsW
PathFileExistsA

wininet

InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetSetOptionW

iphlpapi

GetAdaptersInfo

zbgui

LoadStyleZipMemoryW
WindowManager_Attach
DUI_UnLoad
ReleaseStyle
Plugin_IsValid
Plugin_Redraw
GetPluginByName
MatchString
DUI_Init

tqmeepo

DllInstall
DllGetClassObject

setupapi

SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

ws2_32

closesocket
socket
sendto
setsockopt
htons
connect
inet_ntoa
inet_addr
recv
gethostbyname
send
WSAStartup
recvfrom

d3d9

Direct3DCreate9

Exports

Exports

initns

Sections

.text
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 605KB - Virtual size: 605KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4164ab9ece7707caabc622d8b4314507

Code Sign

31:d8:93:ab:c8:84:26:e7:b3:82:e0:3e:50:08:10:33Certificate

Extended Key Usages

Key Usages

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79Certificate

Extended Key Usages

Key Usages

19:c2:85:30:e9:3b:36Certificate

Key Usages

58:eb:23:d1:3d:30:ec:16:b8:bf:7a:a8:d4:2e:ab:6c:5e:59:6a:46Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

shlwapi

wininet

iphlpapi

zbgui

tqmeepo

setupapi

ws2_32

d3d9

Exports

Exports

Sections

.text Size: 178KB - Virtual size: 178KB

.rdata Size: 50KB - Virtual size: 50KB

.data Size: 10KB - Virtual size: 23KB

.rsrc Size: 605KB - Virtual size: 605KB

.reloc Size: 14KB - Virtual size: 13KB

31:d8:93:ab:c8:84:26:e7:b3:82:e0:3e:50:08:10:33
Certificate

55:33:97:92:c7:54:53:cc:f6:5b:65:d3:f2:bb:00:79
Certificate

19:c2:85:30:e9:3b:36
Certificate

58:eb:23:d1:3d:30:ec:16:b8:bf:7a:a8:d4:2e:ab:6c:5e:59:6a:46
Signer

.text
Size: 178KB - Virtual size: 178KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 10KB - Virtual size: 23KB

.rsrc
Size: 605KB - Virtual size: 605KB

.reloc
Size: 14KB - Virtual size: 13KB