MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3 |
|---|---|
| SHA3-384 hash: | 1ff111f9f983c81201dba6f66cdbd5adef8ce9bba2a5a78e9161f0a8346018906cd2fa22231a7c7595cec205f237aa8b |
| SHA1 hash: | 9ff48900feed1f2433b3ef1610a5fc2b438152de |
| MD5 hash: | 25c4f6ec3f18c71bf9639746b8fe9567 |
| humanhash: | steak-thirteen-charlie-carolina |
| File name: | oUjFYGTrrUoPBIm.dll |
| Download: | download sample |
| File size: | 806'912 bytes |
| First seen: | 2020-03-29 19:17:23 UTC |
| Last seen: | 2020-03-29 19:51:00 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 80ea0151383dbd4d0e5038dee183a8e4 |
| ssdeep | 6144:QnuLP2W5pwK9DgomFrmviQwtDkn6xEiMt3BDCmJzwpYPtz7EhUkm:e/R8viT06jqBD9JzwU9SU5 |
| Threatray | 54 similar samples on MalwareBazaar |
| TLSH | 2B05F5ADA74348E3E7753934A7C20E42551171C9E8200C8FBBBE2E5C6FA97A27D15EC4 |
| Reporter |  Racco42 |
| Tags: | dll ZLoader |
Intelligence
File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Zloader
Detection(s):
Gathering data
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2020-03-29 19:35:36 UTC
File Type:
PE (Dll)
AV detection:
23 of 31 (74.19%)
Threat level:
2/5
Verdict:
malicious
Similar samples:
+ 44 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
vbs dll da164dc8c1baf31539335b6a14ca2f14cc0f8a4a39523479290437d0810b82e3
(this sample)
Delivery method
Other
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN_BASE_API | Uses Win Base API | kernel32.dll::LoadLibraryA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.