MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444
SHA3-384 hash: d3b6eb3f58762421ebfac77f1f15b9e2c256bfcf5f01c2cc40c125d5a2013b21f1bd301fef454c115a2812f7fb03eb5f
SHA1 hash: ed4d4ce16dc3e4cb0b9e07786b0048edadd34e4e
MD5 hash: 49c2f6fa67c7eacefe6108c3a8ab528c
humanhash: bacon-music-early-fifteen
File name:SecuriteInfo.com.Win32.Evo-gen.19849.16517
Download: download sample
File size:1'187'840 bytes
First seen:2024-02-02 03:22:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cbed4e582c938afffc5eed771e69ea4b
ssdeep 24576:X2GzfrvoKANKFg/RQWfxkxoJHexsoh/lhJgew:XrAKbWfs1h/bq9
Threatray 53 similar samples on MalwareBazaar
TLSH T1C245BF02BE9340F3C215553024A7173ADA3BCA664F91ABC3F764DE6CED322919D6F11A
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon 914db3f1f1b359a5
Reporter SecuriteInfoCom
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
303
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/474129/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.19849.16517.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
90%
Tags:
hook keylogger lolbin packed shell32
Link:
https://www.filescan.io/uploads/65bc5fe9b012cce0edb8f381/reports/9dbf2dbd-c676-4f6d-8ea5-2d8cfbadced5/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d70da3c8-070e-4c7f-98ea-13fe0fe225c5
Result
Threat name:
Petite Virus
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1385334
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Petite Virus
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-10-30 05:51:54 UTC
AV detection:
16 of 23 (69.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gvbx5lssz6zjtgynip6yucjocobzoxqzxp5yrlp7xbzwfrebcrca._file
Verdict:
malicious
Similar samples:
1994b5aea0ffc20364530c024facd27e8f0733818f1ef59776256f2d7b384b9d
35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444
6b379fd7445d99d790b00fa433d6a71830fb60fadc524e7ce7b9b2bf8040428b
799b7395c9f279d8cd1cd24657788ecb37db7ae03c0dddeb3344a95a551d1325
a0762a63b9deea8f379d3fe5a2ce0139bb30be3e8bd004ed59defcfa69132105
b02b469a0902282b16e80a46be10ccfafed6a4fce5ec7bc65da0b9764c044ef4
c47a2878fc31c893ecead34851c697424e9e159e34c2ed5c93d6b69cee90cb66
dd0ec925f314210edfffb5638487233cbed59aabcf085d2d372527124ebc759e
faaf2d27ca3c7a332b9c9474b869931e614e77697d30703c4f2c02b14237b019
+ 43 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240202-dwzzlseheq/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444
MD5 hash:
49c2f6fa67c7eacefe6108c3a8ab528c
SHA1 hash:
ed4d4ce16dc3e4cb0b9e07786b0048edadd34e4e
Link:
https://www.unpac.me/results/5d07e56d-573c-45c1-aebb-9f3ef0aa1738/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35437eae52cfb2999b0d43fd8a092e1383975e19bbfb88adffb87362c4811444

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/474129/

Comments