magick[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

magick.exe
Size

22.9MB
MD5

70f07908de689fe13ed81c8d6d4326c9
SHA1

09f21f051fbd80f0ffaab80a8805704bd6e7dee3
SHA256

d5676cd38e76882d47380ba7b32027a9ffbfc69e26fbbef242eb33434ae61e6a
SHA512

7b05698709a6f2b40f47f904b7911d61d8e29686db062d67e1d3e03a219ff3ef631b86e6c9624f72856d70818c74121412ca8e7de35c38797abb57c83680ff8b
SSDEEP

393216:QtXf03vwFDr6+LDIQcgGYD8BWq8sLUV8WIOj7FGZ:MToknXVWZ

Score

1^/10

Malware Config

Signatures

Files

magick.exe
.exe windows:6 windows x64 arch:x64

50400c641bc4202e2f133e8f2569c511

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

16/04/2020, 18:36

Not After

16/04/2045, 18:44

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

25/02/2024, 09:13

Not After

28/02/2024, 09:13

Subject

CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,L=Landenberg,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77
Certificate

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Not Before

25/02/2024, 09:13

Not After

28/02/2024, 09:13

Subject

CN=ImageMagick Studio LLC,O=ImageMagick Studio LLC,L=Landenberg,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Not Before

13/04/2021, 17:31

Not After

13/04/2026, 17:31

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

01/04/2021, 20:05

Not After

01/04/2036, 20:15

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Not Before

19/11/2020, 20:32

Not After

19/11/2035, 20:42

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:29:bc:90:51:87:90:41:72:08:00:00:00:00:00:29
Certificate

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Not Before

18/05/2023, 19:38

Not After

16/05/2024, 19:38

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=Thales TSS ESN:BB73-96FD-77EF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4a:3b:df:30:18:6d:19:79:2a:e0:f6:ce:f9:18:52:75:d8:12:3a:e9:e6:7c:4d:7e:c2:e9:ec:36:fa:03:67:e3
Signer

Actual PE Digest

4a:3b:df:30:18:6d:19:79:2a:e0:f6:ce:f9:18:52:75:d8:12:3a:e9:e6:7c:4d:7e:c2:e9:ec:36:fa:03:67:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetExitCodeProcess
CreateProcessA
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
MapViewOfFile
UnmapViewOfFile
FreeLibrary
FreeResource
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageA
CreateFileMappingA
GetStartupInfoA
FindResourceA
SystemTimeToFileTime
GetCurrentThreadId
OutputDebugStringA
GetLogicalDrives
CreateThread
GlobalAlloc
GlobalSize
GlobalUnlock
GlobalLock
GlobalFree
SetEnvironmentVariableA
CreateFileW
SetFileTime
RtlCaptureContext
RtlLookupFunctionEntry
SetErrorMode
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetFileType
GetConsoleMode
WaitForSingleObject
SetFilePointerEx
SetConsoleCtrlHandler
WriteFile
GetConsoleOutputCP
GetFileAttributesExW
GetDriveTypeW
GetFullPathNameW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetStdHandle
GetTimeZoneInformation
DeleteFileW
DuplicateHandle
FlushFileBuffers
MoveFileExW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentThread
GetCPInfo
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetFileSizeEx
HeapReAlloc
HeapSize
GetCurrentDirectoryW
CreateDirectoryW
FindFirstFileExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
GetLastError
SetHandleInformation
CloseHandle
SetEndOfFile
ReadFile
FindNextFileW
FindFirstFileW
FindClose
GetEnvironmentVariableW
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetShortPathNameW
QueryPerformanceFrequency
QueryPerformanceCounter
PeekNamedPipe
ReadConsoleW
CreatePipe
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
SetUnhandledExceptionFilter
GetDriveTypeA
SleepConditionVariableCS
SignalObjectAndWait
GetTempPathA
GetTempFileNameA
GetPhysicallyInstalledSystemMemory
SetConsoleOutputCP
RtlVirtualUnwind
GetNumberOfConsoleInputEvents
RemoveDirectoryW
FreeLibraryAndExitThread
ExitThread
CompareStringEx
LCMapStringEx
DecodePointer
InitializeCriticalSection
ReleaseMutex
CreateMutexA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
SetThreadPriority
GetThreadPriority
ResumeThread
ExpandEnvironmentStringsW
GetFileInformationByHandleEx
SetConsoleMode
DebugBreak
GetSystemDirectoryW
GetWindowsDirectoryW
CreateEventA
GetVersion
LoadLibraryW
FormatMessageW
GetLocaleInfoA
GetThreadLocale
LoadLibraryA
IsDBCSLeadByteEx
GetFileAttributesW
SetEvent
ResetEvent
ReadConsoleInputA
PeekConsoleInputA
DeviceIoControl
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
RegisterWaitForSingleObject
UnregisterWait
ReleaseSemaphore
CreateSemaphoreA
SetFileAttributesW
GetTickCount
GetFileTime
GetVersionExA
SwitchToThread
InitOnceBeginInitialize
InitOnceComplete
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
InitializeCriticalSectionEx
GetLocaleInfoEx

vcomp140

omp_set_lock
omp_unset_lock
_vcomp_flush
_vcomp_for_dynamic_init
_vcomp_for_dynamic_next
_vcomp_for_static_simple_init
omp_get_max_threads
omp_destroy_lock
_vcomp_set_num_threads
_vcomp_fork
_vcomp_for_static_simple_init_i8
_vcomp_for_static_end
_vcomp_atomic_add_i8
omp_set_nested
omp_get_thread_num
_vcomp_enter_critsect
_vcomp_leave_critsect
_vcomp_barrier
_vcomp_single_begin
_vcomp_single_end
_vcomp_for_dynamic_init_i8
_vcomp_for_dynamic_next_i8
_vcomp_for_static_init_i8
omp_init_lock

ws2_32

WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetEvent
ntohs
htons
htonl
ntohl
connect
listen
recv
send
setsockopt
socket
WSASetLastError
getservbyport
gethostbyname
gethostbyaddr
ioctlsocket
inet_ntoa
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
inet_addr
inet_ntop
inet_pton
getservbyname
accept
bind
closesocket

gdiplus

GdipGetImageVerticalResolution
GdipDrawImageRectI
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipLoadImageFromFile
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImageHorizontalResolution
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear

urlmon

URLDownloadToFileA

user32

MessageBoxA
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
EnumDisplayDevicesA
FillRect
ReleaseDC
GetDC
SystemParametersInfoA
MsgWaitForMultipleObjectsEx
PostMessageA
PeekMessageA

gdi32

GetDeviceCaps
CreateDIBSection
GetOutlineTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharWidth32A
SelectObject
GetGlyphOutlineA
EnumFontFamiliesExW
StretchDIBits
CreateSolidBrush
GdiFlush
GetWorldTransform
ExtSelectClipRgn
SelectClipRgn
IntersectClipRect
GetGraphicsMode
GetClipRgn
GetClipBox
ExtCreateRegion
CreateRectRgn
CreateCompatibleBitmap
ExtTextOutW
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
DeleteObject
DeleteDC
CreateDCA
CreateCompatibleDC
BitBlt
GetFontUnicodeRanges
GetGlyphIndicesW
RestoreDC
SaveDC
SetBkMode
SetGraphicsMode
SetMapMode
SetTextColor
SetTextAlign
CreateFontIndirectW

advapi32

CryptAcquireContextA
RegOpenKeyExW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetFileSecurityW
RegEnumKeyExW
RegLoadMUIStringW
GetSecurityInfo
RegGetValueW
DeregisterEventSource
RegEnumValueW
CryptGenRandom
CryptReleaseContext
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
ReportEventA
RegisterEventSourceA
GetUserNameW

bcrypt

BCryptFinishHash
BCryptDestroyHash
BCryptGenRandom
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptDeriveKeyPBKDF2

shell32

SHFileOperationW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW

ole32

CoTaskMemFree

dnsapi

DnsQuery_A
DnsFree

iphlpapi

NotifyRouteChange2
GetIpForwardTable2
CancelMibChangeNotify2

Sections

.text
Size: 14.8MB - Virtual size: 14.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.0MB - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 392KB - Virtual size: 784KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 543KB - Virtual size: 542KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 1024B - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50400c641bc4202e2f133e8f2569c511

Code Sign

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99Certificate

Key Usages

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77Certificate

Extended Key Usages

Key Usages

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77Certificate

Extended Key Usages

Key Usages

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05Certificate

Key Usages

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07Certificate

Key Usages

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

33:00:00:00:29:bc:90:51:87:90:41:72:08:00:00:00:00:00:29Certificate

Extended Key Usages

Key Usages

4a:3b:df:30:18:6d:19:79:2a:e0:f6:ce:f9:18:52:75:d8:12:3a:e9:e6:7c:4d:7e:c2:e9:ec:36:fa:03:67:e3Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcomp140

ws2_32

gdiplus

urlmon

user32

gdi32

advapi32

bcrypt

shell32

ole32

dnsapi

iphlpapi

Sections

.text Size: 14.8MB - Virtual size: 14.8MB

.rdata Size: 7.0MB - Virtual size: 7.0MB

.data Size: 392KB - Virtual size: 784KB

.pdata Size: 543KB - Virtual size: 542KB

_RDATA Size: 1024B - Virtual size: 560B

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 57KB - Virtual size: 56KB

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99
Certificate

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77
Certificate

33:00:00:51:77:55:ca:35:82:7a:8f:7c:63:00:00:00:00:51:77
Certificate

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05
Certificate

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07
Certificate

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Certificate

33:00:00:00:29:bc:90:51:87:90:41:72:08:00:00:00:00:00:29
Certificate

4a:3b:df:30:18:6d:19:79:2a:e0:f6:ce:f9:18:52:75:d8:12:3a:e9:e6:7c:4d:7e:c2:e9:ec:36:fa:03:67:e3
Signer

.text
Size: 14.8MB - Virtual size: 14.8MB

.rdata
Size: 7.0MB - Virtual size: 7.0MB

.data
Size: 392KB - Virtual size: 784KB

.pdata
Size: 543KB - Virtual size: 542KB

_RDATA
Size: 1024B - Virtual size: 560B

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 57KB - Virtual size: 56KB