MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2dbcaab96b58a2db2649286a6959deed62ee12e8a412022cd9aca0d5050b2bc8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 2dbcaab96b58a2db2649286a6959deed62ee12e8a412022cd9aca0d5050b2bc8 |
|---|---|
| SHA3-384 hash: | 747e9e8b0f450e1c5f98bf06f7c30f35323f0f64c22164cb7cf56bff29b7247c4ac031ee8daad6de276256f141da84bf |
| SHA1 hash: | 826c87582f242044f3a7ce63d0ce09324e4bd8fa |
| MD5 hash: | 86a27da2d8ab1a48e9183e8a868ad569 |
| humanhash: | six-cup-video-victor |
| File name: | DriverFixerProSetup_STD-SILENT.3.exe |
| Download: | download sample |
| File size: | 10'008'214 bytes |
| First seen: | 2025-04-05 13:54:55 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f4639a0b3116c2cfc71144b88a929cfd (131 x GuLoader, 55 x Formbook, 40 x VIPKeylogger) |
| ssdeep | 196608:WvI6S2vsmpqCyo+6omvNAqtJ4/TtVBd9P9TQw+o+y+H1KEm8ovJ38recYkxO3K:WB7dqCh+cltJMTtVhFTl+Fyi4J8iNK |
| TLSH | T181A63391F743287AD2C0C9F065D03B607DEEEFD5654342A2CBA9BE2B1973FE24425864 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | d16072ba8ece6c0c |
| Reporter |  aachum |
| Tags: | exe |
iamaachum
https://github.com/legendary99999/mfd-bfdbbdf/releases/download/vdfbafdbafbd/DriverFixerProSetup_STD-SILENT.3.exeIntelligence
File Origin
# of uploads :
1
# of downloads :
30
Origin country :
ESVendor Threat Intelligence
Detection:
n/a
Verdict:
Malicious
Score:
91.7%
Tags:
injection shellcode obfusc
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
adaptive-context blackhole installer microsoft_visual_cc overlay packed packer_detected
Verdict:
Suspicious
Labled as:
Malware_48.3
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Behaviour
Behavior Graph:
n/a
Score:
65%
Verdict:
Susipicious
File Type:
PE
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
defense_evasion discovery execution persistence trojan upx
Behaviour
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
5a229fdfaac92319a5ae63c9703c81b270632b4648edc52179a33cfdbfa6c928
MD5 hash:
f2702bb47e572b2e747d0f1504e4ee6f
SHA1 hash:
671ad54287dafec74b993bacb135e2f804fb51fe
SH256 hash:
87effc794e141cd8d11efb025dfaa439198d7fc97ca02b30dc7d4fd03dbbc869
MD5 hash:
a3e2db2bbaa75fd5bdb7517b30d662ae
SHA1 hash:
9a041eb411c851e3776f58aba130c0b39ae94530
SH256 hash:
75c183c75ef8a37d036419da61e91cb2c4b6abdc096223a95ef73c630285d4ea
MD5 hash:
e076ee2213b2543bcea9b3346941e902
SHA1 hash:
a3b4b761d30efccaa6ebe0393eb557d9fbf12cb4
SH256 hash:
2eef009ddf20c6285b32debfb878c53bbfc989f6b420f35492eb54d8ab1d45c3
MD5 hash:
0e50dcf0a5aadc786e6d06f5928fa88a
SHA1 hash:
3c1ae02ee2b23890fa0f5d97a8284a19d372b3f7
SH256 hash:
a307ebabea24ee7561a523981b5f3e063973f359cff6a9c06fb78aa2c6c17166
MD5 hash:
97363e57204d47c1cf4a97e779f75218
SHA1 hash:
2182f655f375abcd1c52cfb61fad0ccd3a37a6c5
SH256 hash:
e563857bb0f2126588564cd64c6870447a09eb639e51f1070d03f40cd9a0aa99
MD5 hash:
743dd24d14ddb50dbffd823f210415fe
SHA1 hash:
11a89160d664a303ad8b03d48c546328ccc40328
SH256 hash:
2dbcaab96b58a2db2649286a6959deed62ee12e8a412022cd9aca0d5050b2bc8
MD5 hash:
86a27da2d8ab1a48e9183e8a868ad569
SHA1 hash:
826c87582f242044f3a7ce63d0ce09324e4bd8fa
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 2dbcaab96b58a2db2649286a6959deed62ee12e8a412022cd9aca0d5050b2bc8
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_TRUST_INFO | Requires Elevated Execution (level:requireAdministrator) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| COM_BASE_API | Can Download & Execute components | ole32.dll::CoCreateInstance |
| SECURITY_BASE_API | Uses Security Base API | ADVAPI32.dll::AdjustTokenPrivileges |
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteExW SHELL32.dll::SHFileOperationW SHELL32.dll::SHGetFileInfoW |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetDiskFreeSpaceW KERNEL32.dll::GetCommandLineW |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CopyFileW KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW |
| WIN_BASE_USER_API | Retrieves Account Information | ADVAPI32.dll::LookupPrivilegeValueW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegCreateKeyExW ADVAPI32.dll::RegDeleteKeyW ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW ADVAPI32.dll::RegSetValueExW |
| WIN_USER_API | Performs GUI Actions | USER32.dll::AppendMenuW USER32.dll::EmptyClipboard USER32.dll::FindWindowExW USER32.dll::OpenClipboard USER32.dll::PeekMessageW USER32.dll::CreateWindowExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.