MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 11

Intelligence 11 IOCs YARA 13 File information Comments

SHA256 hash:	0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
SHA3-384 hash:	35bdb6e3d581e5261432fd8b1d447fcccb8274122e0ee63f39fc3051e6888b44b280c748736f0b4c3f1c58e46b37d66c
SHA1 hash:	1fe74457bb066a90991674065e78da541ace0c70
MD5 hash:	bff62f646ae80f98cb0c38d9770ae1dc
humanhash:	juliet-saturn-timing-stream
File name:	SecuriteInfo.com.Riskware.2144FlashPlayer.29011.14806
Download:	download sample
File size:	2'311'096 bytes
First seen:	2025-05-01 23:22:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5aa94c7fbfc01c9462c4d62e06efe88a
ssdeep	49152:8VpwLEDy+7wdKTJ8xMSx12aabHiSkW+tnR0bpWbPEUw+Xx6f7Dd:8Vpa+3V8xazGk+nR0IFEHd
TLSH	T190B5338AC7418EA4E0DA31F564471FCCB36BF306753EC7BD6F82684AF2285935A71891
TrID	46.6% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14) 32.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 8.3% (.EXE) Win64 Executable (generic) (10522/11/4) 3.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	c8c49aa9acd6ea86 (3 x CobaltStrike, 1 x Arechclient2, 1 x BadRabbit)
Reporter	SecuriteInfoCom
Tags:	exe signed

Code Signing Certificate

Organisation:	Adobe Inc.
Issuer:	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-11-03T00:00:00Z
Valid to:	2025-11-04T23:59:59Z
Serial number:	03a641d10af0665bf2f0da0788bcf42d
Intelligence:	23 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	b27ff1970d525809ae6b66bc46be4a3c5f70fe318ebd819fe4c5092092769c7d
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

479

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Riskware.2144FlashPlayer.29011.14806

Verdict:

Malicious activity

Analysis date:

2025-05-01 23:28:37 UTC

Tags:

upx

Link:

https://app.any.run/tasks/b4797fac-e426-4f4b-a59e-31ea5a800e1b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/5670/

Detection(s):

SecuriteInfo.com.Riskware.2144FlashPlayer.29011.14806.UNOFFICIAL

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681405204355f44aee681936

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %temp% subdirectories

Creating a window

Creating a file

Changing a file

DNS request

Connection attempt

Sending a custom TCP request

Moving a recently created file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

installer microsoft_visual_cc packed packed packer_detected pecompact signed

Link:

https://www.filescan.io/uploads/6814025cc7418694c8a440b4/reports/8c6eb57e-16b9-45f9-8c4f-21669a00b4a9/overview

Verdict:

Unknown

Labled as:

2144FlashPlayer.A potentially unwanted application

Link:

https://www.hybrid-analysis.com/sample/0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/0f803207-e789-4ec5-b485-5ae5c3a84ac9

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1679490

Signature

Contains functionality to detect sleep reduction / modifications

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2/

Threat name:

Win32.PUA.FlashUtilities

Status:

Malicious

First seen:

2025-04-09 07:12:14 UTC

File Type:

PE (Exe)

Extracted files:

396

AV detection:

3 of 36 (8.33%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=aucnu7rgocwdhaq3duu2xdsdbpjgfkdt7ud57ltibz4bnryfzxja._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250501-3c619axvhw/

Behaviour

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/0673e638-a7d5-4276-9161-31debaa74f3e

Unpacked files

SH256 hash:

0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2

MD5 hash:

bff62f646ae80f98cb0c38d9770ae1dc

SHA1 hash:

1fe74457bb066a90991674065e78da541ace0c70

Link:

https://www.unpac.me/results/0a086d01-bb67-4997-b09c-10caa5e36baf/

SH256 hash:

94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668

MD5 hash:

1115be7832a7fa6005cb06aa20cdbb5c

SHA1 hash:

d0cf4dcc15749f031b4f5631bd603daf3bae1696

Link:

https://www.unpac.me/results/0a086d01-bb67-4997-b09c-10caa5e36baf/

SH256 hash:

467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21

MD5 hash:

6be622c4fd3a217b3f45dcd0b1897ffe

SHA1 hash:

0d31265517b835028a81eaf4e16dd3b60d4bc874

Detections:

win_samsam_auto

Link:

https://www.unpac.me/results/0a086d01-bb67-4997-b09c-10caa5e36baf/

Parent samples :

e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MAL_packer_lb_was_detected Create hunting rule
Author:	0x0d4y
Description:	Detect the packer used by Lockbit4.0

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pecompact2 Create hunting rule
Author:	Kevin Falcoz
Description:	PECompact

Rule name:	PECompact2xxBitSumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactV2XBitsumTechnologies Create hunting rule
Author:	malware-lu

Rule name:	PECompactv2xx Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/5670/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CoCreateInstance
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA
WIN_BASE_IO_API	Can Create Files	SHELL32.dll::SHCreateDirectoryExW
WIN_SVC_API	Can Manipulate Windows Services	ADVAPI32.dll::OpenServiceW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample