MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34d457a1e0ac2c9ca0535f2cd1a6bc3c43ee8e5a6332366027bc7bcd6db6eb3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34d457a1e0ac2c9ca0535f2cd1a6bc3c43ee8e5a6332366027bc7bcd6db6eb3b
SHA3-384 hash: b1ff5f0a70eebfecc440c2945986aa5076fd8e9f95666e0753f8fa851725deb7adf9748dd92a7f5dd45d646b8acd1bb5
SHA1 hash: 3af2cee2edbdbeedcefe09499ba6db5d27229f6b
MD5 hash: 296b24df8b3f21d2ef1793d334845613
humanhash: vegan-lemon-low-chicken
File name:Trojan-Downloader.Win32.Vqod.pga-34d457a1e0ac2c9ca0535f2cd1a6bc3c43ee8e5a6332366027bc7bcd6db6eb3b
Download: download sample
File size:105'984 bytes
First seen:2022-08-31 04:25:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 09d0478591d4f788cb3e5ea416c25237 (4 x Worm.Mofksys, 3 x Blackmoon, 2 x Gh0stRAT)
ssdeep 1536:hmye6noFHpSyP3nn9cRWyTRwUKQwSUEEpxEIOXDK:8y8dpLFviOUaSUEEDA
TLSH T10FA30ACAE941609DED5EACF0946FBEB4023B5C9688C325D771F5BDBA28724129433C1B
TrID 50.8% (.EXE) Win32 EXE PECompact compressed (v2.x) (59069/9/14)
35.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
4.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.8% (.EXE) Win32 Executable (generic) (4505/5/1)
1.7% (.EXE) OS/2 Executable (generic) (2029/13)
dhash icon 71cc9ab2b29ee871
Reporter OSimao
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/306574/
Detection(s):
PUA.Win.Packer.PECompact-2
Create hunting rule

Win.Trojan.Agent-1049256
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
DNS request
Creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/630ee36d59c0157606baef56/reports/8d1ae469-25fc-481b-9059-b3e408a92dc5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1061213
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34d457a1e0ac2c9ca0535f2cd1a6bc3c43ee8e5a6332366027bc7bcd6db6eb3b/
Threat name:
Win32.Downloader.Lisfonp
Create hunting rule
Status:
Malicious
First seen:
2011-05-21 16:46:00 UTC
File Type:
PE (Exe)
Extracted files:
41
AV detection:
22 of 25 (88.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gtkfpipavqwjzictl4wndjv4hrb65ds2mmzdmybhxr5423nw5m5q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220831-e2hsysadg6/
Behaviour
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
34d457a1e0ac2c9ca0535f2cd1a6bc3c43ee8e5a6332366027bc7bcd6db6eb3b
MD5 hash:
296b24df8b3f21d2ef1793d334845613
SHA1 hash:
3af2cee2edbdbeedcefe09499ba6db5d27229f6b
Link:
https://www.unpac.me/results/58922d31-d1c5-4207-bdc5-193ac6c3977e/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/306574/

Comments