MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
SHA3-384 hash: 8d097e8f5bfb147b5ab9624247656598afbca3ed177182e2f0787415d67985c617fb6b9157243be814ee5fc22962cfe0
SHA1 hash: 20d554a80d759c50d6537dd7097fed84dd258b3e
MD5 hash: 82187ad3f0c6c225e2fba0c867280cc9
humanhash: alpha-carolina-king-wisconsin
File name:_d3dcompiler_47.dll
Download: download sample
File size:5'168'344 bytes
First seen:2023-03-30 10:53:38 UTC
Last seen:2023-04-03 11:49:00 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash dc71769f237c0a3ba38879380c54a4e6
ssdeep 49152:uuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccb:Ky904wYbZCoOI85oyI/8
Threatray 11 similar samples on MalwareBazaar
TLSH T1A6368D5673E940A9C1BBD138CE479213EBB1780403345BEB5191C669EF73BE26A3E724
TrID 90.1% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
4.8% (.EXE) Win64 Executable (generic) (10523/12/4)
2.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.9% (.EXE) OS/2 Executable (generic) (2029/13)
0.9% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter Anonymous
Tags:3CX exe LABYRINTH CHOLLIMA signed

Code Signing Certificate

Organisation:Microsoft Corporation
Issuer:Microsoft Code Signing PCA 2010
Algorithm:sha256WithRSAEncryption
Valid from:2020-12-15T21:24:20Z
Valid to:2021-12-02T21:24:20Z
Serial number: 33000003dffb6ae3f427ecb6a30000000003df
Thumbprint Algorithm:SHA256
Thumbprint: 4a838904e732a380e2856a9d6fee926e5c57eb59336292ac5d9e47c9b2c1ed13
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
386
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
11be.msi
Verdict:
No threats detected
Analysis date:
2023-03-30 09:06:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/0c01a6cd-b912-4fc5-bcd8-b9307ec0580e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/378806/
Detection(s):
SecuriteInfo.com.SmoothOperator.8184.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware hacktool overlay packed
Link:
https://www.filescan.io/uploads/64256a4d4fbb909ff92e5bf6/reports/157c960c-0c7c-43dd-9fb3-9a0a05658193/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/584f6214-9a26-4ddf-91a0-e38cc558fd18
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1205058
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 837971 Sample: _d3dcompiler_47.dll.exe Startdate: 30/03/2023 Architecture: WINDOWS Score: 48 28 Multi AV Scanner detection for submitted file 2->28 8 loaddll64.exe 1 2->8         started        process3 process4 10 cmd.exe 1 8->10         started        12 rundll32.exe 8->12         started        14 rundll32.exe 8->14         started        16 7 other processes 8->16 process5 18 rundll32.exe 10->18         started        20 WerFault.exe 9 12->20         started        22 WerFault.exe 9 14->22         started        24 WerFault.exe 9 16->24         started        process6 26 WerFault.exe 21 9 18->26         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2023-03-22 09:04:54 UTC
File Type:
PE+ (Dll)
AV detection:
15 of 37 (40.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cg7bqa7c4md3mr5iu7qc2eudgxcer73udpygx5jlgmxaxp2chmbq._file
Verdict:
unknown
Similar samples:
11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
a8ef7985e7e029c6f66dd8571568d053c1a65b5d493553bb20fae8846a7ae2e4
b813f93f24761505af2792be190b5cc19838252fcbdeea9946216964f7649ee8
d9138877762b03c339c0bea690551fbb946681e4c5b3e98dab367f15a2d8411b
dc7eab933986b8ff95bd88eff8d925ff1311c451ca1f88e1fd96eee10714ded2
+ 1 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230330-mzjw8scc83/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
MD5 hash:
82187ad3f0c6c225e2fba0c867280cc9
SHA1 hash:
20d554a80d759c50d6537dd7097fed84dd258b3e
Link:
https://www.unpac.me/results/cff07ae0-a8bb-463e-8fb3-1364b4cbf3af/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.virustotal.com/gui/file/11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03
Cape
Cape
https://www.capesandbox.com/analysis/378806/

Comments