MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 15


Intelligence 15 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
SHA3-384 hash: 1164e8da21c94cdad9b99d54efba591dfe4d2f977d09c95e19683dc3fef2d588fc06a9a35df6a623db29b8a7d39b58f5
SHA1 hash: 8e09178718e148fa10fbbe1b3fe4342dedf08792
MD5 hash: 77b42a35bfe338b4f66426bf50708718
humanhash: william-high-sad-maryland
File name:SecuriteInfo.com.PUA.Tool.VulnDriver.6.16877.1293
Download: download sample
File size:46'592 bytes
First seen:2024-07-04 06:25:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f66a84d3ddeaa8ad2b3020a656cf1933
ssdeep 768:31WAgvqaEohTMk31TMbYI3aW31MjHCPip1MmMbC0ur:31zLs512YI3H1MjHCPizDoC02
TLSH T1E5237C86936019FAC48BC535C5FB8D27E8B0F8455B2287CF966086764EB1FE43A3D349
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b.exe
Verdict:
No threats detected
Analysis date:
2024-07-04 06:27:55 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/12c92f56-93b6-447b-8a23-44093a4e9da1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.PUA.Tool.VulnDriver.6.16877.1293.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=668640e094b35ad6fbebbdeewin10vpnfull_triage
Tags:
Static Generickd
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm masquerade microsoft_visual_cc pup
Link:
https://www.filescan.io/uploads/668640800bf5978c0b14c5d7/reports/dff17682-8494-4eeb-bd1a-2e663af2edf6/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b73db600-c84c-4204-9c2c-54fc37166c47
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1467426
Signature
AI detected suspicious sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Behaviour
Behavior Graph:
Download SVG
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b/
Threat name:
Win64.PUA.GameHack
Create hunting rule
Status:
Malicious
First seen:
2023-05-14 19:31:00 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
10 of 24 (41.67%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dborvkn76g4pkhjxd2fuoearusaw44twapw5g2ce3j7pyymdgbfq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240704-g663fsycqm/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/76781017-62c2-4b33-9abc-1cdbe4522815
Unpacked files
SH256 hash:
31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427
MD5 hash:
9ab9f3b75a2eb87fafb1b7361be9dfb3
SHA1 hash:
fe10018af723986db50701c8532df5ed98b17c39
Detections:
PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4
Create hunting rule
VULN_PUA_GIGABYTE_Driver_Jul22_1
Create hunting rule
Link:
https://www.unpac.me/results/b29931a0-f385-43d1-ae06-f412ac2f146b/
Parent samples :
262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
7a976388b064594086b73e3e08a3b95b97a9eea7610bf9c4ac53a2d10304e12b
7b4ca5b780438bef6eca1d5241c5a5f9afbed7e9eacc62300c5ac64fe9e1030a
cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6
638bfb452ad5c2ce2bc9aab6a7dd65665b886d79abd1ce66e617d33781036764
7409f72c3bec45343af484f26fefee09ec591ddc2f87aaff261337209dcbedc4
884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
4bf19e234784a69a8e42fa345a703af865dbf4b58342af810dc51d5d902211c8
2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482
cab05e6b1c523c1c04f1c8806bcb1f1a0e2418f8179f57db80aa1dc5cd939844
f2943a108d98faef6c3411f0ad1235f85f3196cff70cd7d48565c92d0a21d060
3a9fe422216a414d420cbd1e20186da127fb5be80d50f40ef7db6215b7feb2f1
ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581
cbb5470f103fe2ef9344dbd99f892fd31f687c62225abdfaa76d3eea8b36feb4
SH256 hash:
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
MD5 hash:
77b42a35bfe338b4f66426bf50708718
SHA1 hash:
8e09178718e148fa10fbbe1b3fe4342dedf08792
Detections:
PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4
Create hunting rule
VULN_PUA_GIGABYTE_Driver_Jul22_1
Create hunting rule
Link:
https://www.unpac.me/results/b29931a0-f385-43d1-ae06-f412ac2f146b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4
Create hunting rule
Author:Florian Roth
Description:Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys
Reference:https://github.com/magicsword-io/LOLDrivers
Rule name:VULN_PUA_GIGABYTE_Driver_Jul22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges
Reference:https://twitter.com/malmoeb/status/1551449425842786306

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlCreateRegistryKey
ntdll.dll::RtlWriteRegistryValue
ntdll.dll::RtlInitUnicodeString
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
ntdll.dll::NtQuerySystemInformation
WIN_BASE_IO_APICan Create Filesntdll.dll::NtCreateFile
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
ntdll.dll::NtDeviceIoControlFile

Comments