🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d
SHA3-384 hash: a3eed2fdc444a6c367f745ceda412029077af6184886b0b51ba5ffcda3419f0624d28c9836a708c7e39ed3bc0dad0d3e
SHA1 hash: e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae
MD5 hash: 515198a8dfa7825f746d5921a4bc4db9
humanhash: equal-sixteen-bulldog-nitrogen
File name:WindowsUpdate.exe
Download: download sample
File size:778'752 bytes
First seen:2022-11-23 18:07:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0dc8590769efaccd25273172540c1f5c
ssdeep 12288:7Lthbs5mJybBx5PK7+PTjslKd+FKxkQ+5qgIU5fZf+FQ/JSD39WRkZYZ6fLr:fbgvFCGTKKxNiqtU5Rf+W/kPZYwzr
Threatray 352 similar samples on MalwareBazaar
TLSH T125F422CC7781894CDB7CC374191DC9791B9D9C75ED8B82EAFB8936C82C7628C3616A12
TrID 52.9% (.EXE) Win32 Executable (generic) (4505/5/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 0906000000000609
Reporter Cyber_Cat_2022
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
181
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://github.com/Endermanch/MalwareDatabase/raw/master/jokes/WindowsUpdate.zip
Verdict:
No threats detected
Analysis date:
2020-01-27 21:10:23 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9e2471c1-01c2-4ca6-b97a-54ed6e059cb2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337797/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.32761282.6077.14822.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed shell32.dll
Link:
https://www.filescan.io/uploads/637e6183559d07a06f470f51/reports/c12745e1-28d5-448d-abd5-825cc0c3154c/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/02126f2d-0744-428d-9c67-e65c966b1396
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1119977
Signature
Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d/
Threat name:
Win32.Trojan.Dynamer
Create hunting rule
Status:
Malicious
First seen:
2019-10-07 00:38:23 UTC
File Type:
PE (Exe)
Extracted files:
52
AV detection:
25 of 41 (60.98%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=b7nbo2yzskk7ol5pyo6cltx2e75ej3lxclb2etfcicjbpzbqinwq._file
Verdict:
malicious
Similar samples:
0b1f6297e8bfa8fc9ff8a7ad85487ff456c0d66ef2d908588cd27345fba5f4e6
0cf9f04f7c839b0d5f5cd4d111588c43281fa53acc8e9c56058e89d289a54b40
359f9ca568b7525fa41e8ce63450ef4fe1f5c4ba5a334d1473ef93867b21f8a5
6a057c152abb59ec3c2327352401f03fe611e1b52d5507b144e39fc4b393b804
a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
ee08608492383853c0cf59e355f9721f413d83f18d3e4a2c344f5b90407caf4a
f8d665d64793bd0d9c015c19f5eef47e7ece8e03f932e98bec38483dc2afdaad
+ 342 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/221123-wqwdcaff4t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Unpacked files
SH256 hash:
372bf8e63c7d88f66ea82fbf33acfc57ae3feb47a690a93f8954c59d60dba1ed
MD5 hash:
a2a309db59aba166458fba75002a7446
SHA1 hash:
f89e37c51959d305b5b672a6cde11b826dc9f820
Link:
https://www.unpac.me/results/0fef9e7a-763d-4982-843f-59833881f60a/
SH256 hash:
0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d
MD5 hash:
515198a8dfa7825f746d5921a4bc4db9
SHA1 hash:
e1da0b7f046886c1c4ff6993f7f98ee9a1bc90ae
Link:
https://www.unpac.me/results/0fef9e7a-763d-4982-843f-59833881f60a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DeathRansom
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0fda176b199295f72fafc3bc25cefa27fa44ed7712c3a24ca2409217e430436d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/337797/

Comments