MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e313f57f18897c99dd4718ff31449333e79281266f068f88aa2957ccfcaab03c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e313f57f18897c99dd4718ff31449333e79281266f068f88aa2957ccfcaab03c
SHA3-384 hash: ba2e90e3b4c4135edad1e1c0e0420b8a0ffd74094a2eee2102c167d6c95b1b7472a04bd5077485209d710fa79a47d541
SHA1 hash: 3762d025e5f8da0c77bc88295792992227f9fcf7
MD5 hash: 1aaea2811b051fdf83621e7e1a686e85
humanhash: autumn-oscar-romeo-seven
File name:e313f57f18897c99dd4718ff31449333e79281266f068f88aa2957ccfcaab03c
Download: download sample
File size:786'432 bytes
First seen:2020-03-23 16:25:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b28df6b20bf1d2940e8ed810696eb077
ssdeep 12288:HL4QngNOhbC/1WkPmVRdx10VMo58tMyFs2Y0Y:0k0mdx1F82Y
Threatray 2 similar samples on MalwareBazaar
TLSH 8CF49D12B2D1C07BD1B200740EA97B6AA6F9FDB24B199DC373C03B6D0DB65C15B3691A
Reporter Marco_Ramilli
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Virut.369.16323.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Virus.Virut
Create hunting rule
Status:
Malicious
First seen:
2019-07-30 12:08:06 UTC
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
24281a0df86578765573d6bfacf75d5e7014c362b651d579538012a639ae2fcc
ff6353b97df24c70f01f79c12c29d597c8fdf84675fa4ccae6994c5e8e9798cf
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe e313f57f18897c99dd4718ff31449333e79281266f068f88aa2957ccfcaab03c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/220863/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::BuildExplicitAccessWithNameA
ADVAPI32.dll::FreeSid
ADVAPI32.dll::GetLengthSid
ADVAPI32.dll::GetNamedSecurityInfoA
ADVAPI32.dll::IsValidSid
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoFreeUnusedLibraries
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaMSVFW32.dll::ICClose
MSVFW32.dll::ICCompressorFree
MSVFW32.dll::ICOpen
MSVFW32.dll::ICSendMessage
MSVFW32.dll::ICSeqCompressFrame
MSVFW32.dll::ICSeqCompressFrameEnd
MSVFW32.dll::ICSeqCompressFrameStart
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AddAccessAllowedAce
ADVAPI32.dll::AdjustTokenPrivileges
ADVAPI32.dll::GetTokenInformation
ADVAPI32.dll::SetSecurityDescriptorDacl
SHELL_APIManipulates System ShellSHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetSystemInfo
KERNEL32.dll::GetStartupInfoA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileA
KERNEL32.dll::GetWindowsDirectoryA
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupAccountNameA
ADVAPI32.dll::LookupAccountSidA
ADVAPI32.dll::LookupPrivilegeValueA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegQueryValueA
ADVAPI32.dll::RegQueryValueExA
WIN_SOCK_APIUses Network to send and receive dataWS2_32.dll::WSAIoctl
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ControlService
ADVAPI32.dll::OpenSCManagerA
ADVAPI32.dll::OpenServiceA
ADVAPI32.dll::QueryServiceStatus
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::CloseDesktop
USER32.dll::EmptyClipboard
USER32.dll::OpenClipboard
USER32.dll::OpenInputDesktop
USER32.dll::PeekMessageA

Comments