MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c
SHA3-384 hash: a39dcf6a6d0c92416adcf98370a8eca57f1cb8dfc4986ac2ad4595141fe65fd8b90b89523fb9a1845ba5dfc87c39152e
SHA1 hash: e8255975e2ca659e6a0a883c9cd4d78e7f1af7f1
MD5 hash: 328e234c5213dcd142ef9f1f1c1e622e
humanhash: diet-undress-jig-quebec
File name:SecuriteInfo.com.Riskware.2144FlashPlayer.3221.15036
Download: download sample
File size:2'307'568 bytes
First seen:2024-01-19 06:19:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5aa94c7fbfc01c9462c4d62e06efe88a
ssdeep 49152:rMKP2Vh29Iq+6Qt5BOQuP+wYiXJ2xY9qpJ5UAuMLDdGF4+oDzMoaNzb6QA:rMKP2VjnttPrQvAxsbAXPdiazMoaVW
Threatray 9 similar samples on MalwareBazaar
TLSH T171B53395C309D5A2D21872F6444FDFAF43A0EB18392E871C6E672E48FE3192779391E1
TrID 46.6% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14)
32.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
8.3% (.EXE) Win64 Executable (generic) (10523/12/4)
3.9% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.5% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c8c49aa9acd6ea86 (3 x CobaltStrike, 1 x Arechclient2, 1 x BadRabbit)
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:Adobe Inc.
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2022-05-02T00:00:00Z
Valid to:2024-05-01T23:59:59Z
Serial number: 06611c8eb8a1e9b65307c17604881adf
Intelligence: 9 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 76541b93e889b5827c982bf296b68c70fa73fc3d9d155141899944f20250258f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
316
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471621/
Detection(s):
SecuriteInfo.com.Riskware.2144FlashPlayer.3221.15036.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the %temp% subdirectories
Creating a window
Creating a file
Changing a file
DNS request
Sending a custom TCP request
Moving a recently created file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
installer lolbin overlay packed packed pecompact shell32
Link:
https://www.filescan.io/uploads/65aa14963c61cd5b42520af4/reports/5c14dba8-8aed-4891-95c3-807c573d3f96/overview
Verdict:
Malicious
Labled as:
2144FlashPlayer.A potentially unwanted application
Link:
https://www.hybrid-analysis.com/sample/02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/96448b1f-b429-451c-9f40-3493effc6095
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
51 / 100
Link:
https://www.joesandbox.com/analysis/1377246
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Potentially malicious time measurement code found
Behaviour
Behavior Graph:
Download SVG
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=alb3l3fwv6ubu35yklnn2jw6tqpeqw2z2h6dwkezg4n6aoxrw6oa._file
Verdict:
unknown
Similar samples:
02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c
468d71fc7e7a6d72d51c2f61f6463d625ef29fe3b90198d3b6cc3cf892d24301
4a7753f21e2c304d33a8ce823f0cf61de8c43f906c172dd69414d82da6a50ead
77e4776f6db16b38b2bd6cd494017379be4cb291caab5300764c9d2857c49108
8f6483a13e91537054ed7f2a65d755dc447fbf092dbd2069058a7f42ed8065b2
ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280
c3c8a11d78c3401c51a69fa84da23061174de66413adadb1b7b1b494ff55f74e
c3d80a43ca2e0d09cf23097aac6f1970d90a277ca4fdd0aedf5ecc8526ecdba4
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240119-g3rhlahab8/
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21
MD5 hash:
6be622c4fd3a217b3f45dcd0b1897ffe
SHA1 hash:
0d31265517b835028a81eaf4e16dd3b60d4bc874
Link:
https://www.unpac.me/results/610c9f78-c679-4e51-ac96-09a077374ae2/
Parent samples :
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca
SH256 hash:
94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668
MD5 hash:
1115be7832a7fa6005cb06aa20cdbb5c
SHA1 hash:
d0cf4dcc15749f031b4f5631bd603daf3bae1696
Link:
https://www.unpac.me/results/610c9f78-c679-4e51-ac96-09a077374ae2/
SH256 hash:
02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c
MD5 hash:
328e234c5213dcd142ef9f1f1c1e622e
SHA1 hash:
e8255975e2ca659e6a0a883c9cd4d78e7f1af7f1
Link:
https://www.unpac.me/results/610c9f78-c679-4e51-ac96-09a077374ae2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/02c3b5ecb6afa81a6fb852dadd26de9c1e485b59d1fc3b2899371be03af1b79c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pecompact2
Create hunting rule
Author:Kevin Falcoz
Description:PECompact
Rule name:PECompact2xxBitSumTechnologies
Create hunting rule
Author:malware-lu
Rule name:PECompactV2XBitsumTechnologies
Create hunting rule
Author:malware-lu
Rule name:PECompactv2xx
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/471621/

Comments