D:\jenkins\workspace\pc-2345softmgr-build\SoftMgr\main\bin\Win32\release\pdb\2345SoftMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-06_ab5014042ae88afb71d60729bacd9751_hijackloader_luca-stealer_magniber.exe
Resource
win7-20240708-en
General
-
Target
2024-12-06_ab5014042ae88afb71d60729bacd9751_hijackloader_luca-stealer_magniber
-
Size
4.0MB
-
MD5
ab5014042ae88afb71d60729bacd9751
-
SHA1
76f04477693977cc6746ccb408ae52bee9426de5
-
SHA256
7e4602562fb62625223672ca2fed6646bb00c8a0b6fb3356c4bf6313b2a0329a
-
SHA512
b4919fdc4a73e3d6033a176cf96fde6129a7f69a4c6b5a006ac85c5448e493869787cbf5f23985acdb27f163662e8aefecb5115ff74d0567cd238e9dbf06ab94
-
SSDEEP
49152:48pYum/uZNtVIhbeqLPPn6qV5ZTclKeK2q6uKc/NTlmKEgJ8/9XElOLmsG5C2BtR:Nm/m72hnXRTJ+q6sf8/9XE4p2Btqueq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-06_ab5014042ae88afb71d60729bacd9751_hijackloader_luca-stealer_magniber
Files
-
2024-12-06_ab5014042ae88afb71d60729bacd9751_hijackloader_luca-stealer_magniber.exe windows:5 windows x86 arch:x86
4a0398e4346b7b53919527ec295446cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
crypt32
CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptDecodeObject
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
kernel32
VirtualFree
VirtualProtect
VirtualQuery
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
SetLastError
WaitForMultipleObjects
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
ReadFile
SetEndOfFile
GetFileSize
GetComputerNameW
GetTickCount
WaitForSingleObject
SetEvent
GetACP
GlobalMemoryStatusEx
InterlockedExchange
InterlockedExchangeAdd
lstrlenW
GetPrivateProfileStringW
GetModuleHandleW
GetVersionExW
GetFileAttributesW
OpenEventW
WTSGetActiveConsoleSessionId
OpenMutexW
UnmapViewOfFile
CreateEventW
CreateFileMappingW
VirtualAlloc
OpenFileMappingW
HeapCompact
DeleteFileA
GetVersionExA
CreateFileA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnlockFileEx
GetFullPathNameA
LockFile
HeapCreate
AreFileApisANSI
FlushInstructionCache
InterlockedCompareExchange
GetLogicalDriveStringsW
GetDiskFreeSpaceW
GetVolumeInformationW
GetCurrentThread
GetDriveTypeW
GetVersion
DeviceIoControl
ExpandEnvironmentStringsW
GetCurrentProcess
DeleteFileW
lstrcpyW
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcmpA
LocalAlloc
GetProcessHeap
LocalFree
HeapAlloc
GlobalFree
GlobalAlloc
OpenProcess
HeapFree
GetLocalTime
GetCurrentThreadId
CreateFileW
SetFilePointer
WriteFile
GetProcAddress
GetWindowsDirectoryW
CreateDirectoryW
GetEnvironmentVariableW
SetEnvironmentVariableW
FreeLibrary
DeleteCriticalSection
DecodePointer
LoadLibraryW
RaiseException
Sleep
InitializeCriticalSectionAndSpinCount
GetCurrentProcessId
MoveFileExW
CloseHandle
GetLastError
CreateMutexW
GetModuleFileNameW
HeapDestroy
UnlockFile
CreateFileMappingA
EnumResourceNamesW
SizeofResource
GetUserDefaultLangID
IsWow64Process
ReadProcessMemory
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
WriteConsoleW
HeapSize
SetStdHandle
OutputDebugStringA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
LockFileEx
MapViewOfFile
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapReAlloc
SetConsoleCtrlHandler
GetModuleFileNameA
ExitProcess
ExitThread
RtlUnwind
WaitForMultipleObjectsEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
SetProcessAffinityMask
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
WritePrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileSectionW
GetSystemDirectoryW
FindFirstFileW
FindNextFileW
FindClose
CreateProcessW
QueryInformationJobObject
WriteProcessMemory
AssignProcessToJobObject
CreateJobObjectW
IsProcessInJob
GetModuleHandleA
VirtualAllocEx
CreateRemoteThread
TerminateJobObject
GetExitCodeProcess
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
SearchPathW
MultiByteToWideChar
WideCharToMultiByte
QueryDosDeviceW
TerminateProcess
LoadLibraryA
LockResource
GetSystemInfo
LoadResource
FindResourceW
lstrcmpiW
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
ReleaseMutex
LoadLibraryExW
ResetEvent
SetFileTime
GetFileTime
GetComputerNameExW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
CopyFileW
GetTempFileNameW
MoveFileW
lstrcatW
GetFileSizeEx
FormatMessageW
GetStringTypeW
EncodePointer
RtlCaptureStackBackTrace
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
GetCPInfo
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
DuplicateHandle
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RtlCaptureContext
ReleaseSemaphore
InterlockedDecrement
GetProcessId
TerminateThread
CreateThread
CreateSemaphoreW
InterlockedIncrement
OpenThread
VirtualQueryEx
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
FormatMessageA
user32
PostQuitMessage
DefWindowProcW
GetMessageW
DestroyWindow
CreateWindowExW
RegisterClassExW
DispatchMessageW
TranslateMessage
GetWindowLongW
GetWindow
SendMessageTimeoutW
FindWindowW
SetWindowLongW
GetWindowThreadProcessId
CreateIconFromResourceEx
PrivateExtractIconsW
DestroyIcon
LoadCursorW
FindWindowExW
IsWindowVisible
SendMessageW
ShowWindow
IsWindow
SetForegroundWindow
SystemParametersInfoW
GetActiveWindow
UnregisterClassW
PostMessageW
GetIconInfo
OpenDesktopW
CloseDesktop
GetWindowTextW
ReleaseDC
GetDesktopWindow
EnumDesktopWindows
EnumChildWindows
GetDC
GetWindowTextLengthW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetParent
EnumDisplaySettingsW
IsZoomed
GetClassNameW
SetFocus
GetForegroundWindow
AttachThreadInput
GetMonitorInfoW
WindowFromPoint
GetShellWindow
GetSystemMetrics
MonitorFromWindow
SetWindowPos
GetFocus
GetWindowRect
LoadImageW
LookupIconIdFromDirectoryEx
gdi32
CreateCompatibleDC
GetStockObject
GetObjectW
GetTextExtentPointW
GetTextExtentExPointW
SelectObject
DeleteDC
GetDIBits
DeleteObject
CreateFontIndirectW
advapi32
LookupPrivilegeValueW
RegisterEventSourceW
DeregisterEventSource
SetEntriesInAclW
SetNamedSecurityInfoW
IsValidSid
OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
GetTokenInformation
GetLengthSid
ConvertSidToStringSidW
SetTokenInformation
CreateProcessAsUserW
DuplicateTokenEx
CreateServiceW
QueryServiceStatus
ChangeServiceConfig2W
DeleteService
ControlService
SystemFunction036
CheckTokenMembership
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
ReportEventW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
shell32
ShellExecuteExW
ExtractIconExW
SHGetDesktopFolder
SHFileOperationW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetMalloc
ord727
DuplicateIcon
ShellExecuteW
SHGetSpecialFolderPathW
SHChangeNotify
ole32
OleInitialize
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
OleUninitialize
CoTaskMemFree
oleaut32
VariantClear
SysFreeString
SysAllocString
shlwapi
PathFileExistsW
SHDeleteKeyW
PathRemoveFileSpecW
wininet
InternetGetConnectedState
InternetCheckConnectionW
iphlpapi
GetAdaptersInfo
imagehlp
ImageEnumerateCertificates
ImageRemoveCertificate
wtsapi32
WTSQueryUserToken
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
gdiplus
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateHICONFromBitmap
GdipLoadImageFromFile
GdipGetImageRawFormat
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
GdipLoadImageFromFileICM
GdipGetImageHeight
Exports
Exports
CheckSignerInfo
ExportFunc01
ExportFunc02
IsNetConnect
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 587KB - Virtual size: 586KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 33KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 204KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE