MagnetRAMCapture[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MagnetRAMCapture.exe
Size

343KB
MD5

51d286bdf58359417a28e3132aba957f
SHA1

6fa7c189b736808c66c82ccf5f4aaa11f995c95a
SHA256

72dc1ba6ddc9d572d70a194ebdf6027039734ecee23a02751b0b3b3c4ea430de
SHA512

6559fb6fae7f8bcf17678d1e4d0b6e114171b8a8ad5428ba5f18eddf590ac4bebd785d3357494c009fba63f21dec0d03de448098c01fb0f7af3813405da91f28
SSDEEP

3072:grYXq3I6YMFFTUfL/HbYXQFUof0NuHeSrQIjn9k0jJ709s0O:aT8yGfLTFTFHeSXjrW9hO

Score

1^/10

Malware Config

Signatures

Files

MagnetRAMCapture.exe
.exe windows:4 windows x86 arch:x86

2d1e1973ab62e7f5a515d097b09b4a30

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

36:31:3c:71:5c:6e:70:3d:29:33:61:c4
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

09/07/2018, 19:12

Not After

09/10/2021, 19:12

Subject

CN=Magnet Forensics Inc.,O=Magnet Forensics Inc.,L=Waterloo,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c176a6164406d61676e6574666f72656e736963732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a5:37:c7:5f:c8:09:99:8d:2f:3d:cf:58:75:f9:7c:ab:cb:dd:66:9f
Signer

Actual PE Digest

a5:37:c7:5f:c8:09:99:8d:2f:3d:cf:58:75:f9:7c:ab:cb:dd:66:9f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaCyMul
__vbaAryMove
__vbaFreeVar
__vbaStrVarMove
__vbaLineInputStr
__vbaLenBstr
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFpCDblR8
__vbaFreeObjList
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord626
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
__vbaLsetFixstr
ord660
__vbaRecDestruct
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
ord666
__vbaAryDestruct
__vbaLateMemSt
__vbaExitProc
__vbaOnError
__vbaCyAdd
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVar
__vbaFpR8
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
ord709
__vbaErase
__vbaVarZero
ord632
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaCyI2
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaCyI4
__vbaObjVar
__vbaPrintObj
DllFunctionCall
ord670
__vbaVarOr
__vbaCySub
_adj_fpatan
__vbaFixstrConstruct
__vbaR8Cy
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord601
_CIsqrt
EVENT_SINK_QueryInterface
ord710
__vbaFpCmpCy
__vbaExceptHandler
__vbaStrToUnicode
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
ord608
ord716
__vbaFPException
ord717
__vbaInStrVar
__vbaUbound
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
__vbaInStr
__vbaNew2
__vbaCyMulI2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
ord681
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaI4Var
__vbaFpCy
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
ord616
__vbaVarLateMemCallLd
__vbaLateMemCallLd
__vbaRecDestructAnsi
ord617
_CIatan
ord618
__vbaCastObj
__vbaStrMove
__vbaI4Cy
ord619
ord650
_allmul
_CItan
__vbaNextEachCollAd
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 180KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d1e1973ab62e7f5a515d097b09b4a30

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cdCertificate

Extended Key Usages

Key Usages

36:31:3c:71:5c:6e:70:3d:29:33:61:c4Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

a5:37:c7:5f:c8:09:99:8d:2f:3d:cf:58:75:f9:7c:ab:cb:dd:66:9fSigner

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 148KB - Virtual size: 145KB

.data Size: 4KB - Virtual size: 5KB

.rsrc Size: 180KB - Virtual size: 177KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:26:d2:e8:3f:26:02:d4:82:5a:cd
Certificate

36:31:3c:71:5c:6e:70:3d:29:33:61:c4
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

a5:37:c7:5f:c8:09:99:8d:2f:3d:cf:58:75:f9:7c:ab:cb:dd:66:9f
Signer

.text
Size: 148KB - Virtual size: 145KB

.data
Size: 4KB - Virtual size: 5KB

.rsrc
Size: 180KB - Virtual size: 177KB