MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fdd3705ace080c5b72d00cdb7e84f0c0438fb535673b0b1cf9b01439628a89c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0fdd3705ace080c5b72d00cdb7e84f0c0438fb535673b0b1cf9b01439628a89c
SHA3-384 hash: 29597b609f490c92034f4c2b29192a82c40bca663bd966c278f372656deda116b53013e17f3273cf987cae30366fcdd3
SHA1 hash: 773148626f22566234298aa58b5ac07aff68eb50
MD5 hash: 625ff0d8855ec10948d0b888078fcfe0
humanhash: utah-football-pizza-nineteen
File name:0fdd3705ace080c5b72d00cdb7e84f0c0438fb535673b0b1cf9b01439628a89c
Download: download sample
File size:559'856 bytes
First seen:2020-11-07 20:18:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c581e778ba559d8e6a1073ed4b145b6f (87 x Adware.Breitschopp)
ssdeep 12288:fdn4lf6jX90l9MuMIGBy57vBDQn28fYyyApErzlMkc9A7Z29:fmCXiMuMzBg7vk28fYyyKErzl9nlI
Threatray 27 similar samples on MalwareBazaar
TLSH 72C47D2BB251E277D46308B25F9BA33B04759736A52DD502B3542E1FEA703E0AB2435F
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.DownloadGuide-6.UNOFFICIAL
Create hunting rule

Win.Malware.Downloadguide-6803841-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a window
DNS request
Connecting to a non-recommended domain
Sending an HTTP POST request
Sending an HTTP GET request
Moving a recently created file
Searching for the window
Changing a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0fdd3705ace080c5b72d00cdb7e84f0c0438fb535673b0b1cf9b01439628a89c/
Threat name:
Win32.PUA.DownloadGuide
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 20:38:31 UTC
AV detection:
22 of 28 (78.57%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
0c981b3376b642732447b54c0c30d95f3db43bf28eafb558a331be1e50844892
1498c0b157ad0e0f78e94a23107b8a88d96d3cb2a1517f1e1366bc11899d2ba7
4336351dad44438b1165f52112689b6927f6a5e00e4d7b439f590ce3fe555bf3
4dced5327dccc19a9bf68367066fdcd8a511b305a620f14ad4e1dd9ad38eea03
5a0d7b3f57455bee42c6418e201f324809329bcc0f64055d6e19bf6414361cd4
8079c09d13f40eb14c41a72ca3a0ce4c41ad8171474c76553ad41e095aa4acc5
cc8f3215b16d4b0440f90052435e5d9c9198f1852b6f42413ba5b99c39c486da
dfb8828c36b6f215c3fcbbc03adcd37a6ec9b7f5228956f96802704e4eee4d2e
f1d3f02973038d8f1882957ee0162f07f0d8d9a5f09e52d44720e2cb6485b696
ff333618cb439dfca3310d5755c14d6a98063ab01745d161269b21c120075030
+ 17 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201108-qrkcd69k4s/
Behaviour
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments