MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893
SHA3-384 hash: c29439bf088c10ceb98ed7e8c04fd4cf8faba38c66cd931afdac268a852757179bcb96ae1a51fb717688d6ddca689876
SHA1 hash: 71dd40687f503c72b9a5a4051ed61b523d8f98b5
MD5 hash: ace147cef2116853ecc46a2033dd6428
humanhash: emma-chicken-autumn-ceiling
File name:doc-235.exe
Download: download sample
File size:762'318 bytes
First seen:2023-09-22 16:57:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 483f0c4259a9148c34961abbda6146c1 (17 x ValleyRAT, 8 x AsyncRAT, 7 x QuasarRAT)
ssdeep 12288:W3MjhvC888888888888W88888888888RrIqKhNUap03V4J/Yc+X5nOFMFRBKymA5:gMjh0EqKsGCc/Y7X5zhKn4M8Aho
Threatray 24 similar samples on MalwareBazaar
TLSH T1C9F40232F3C30471E57A19799F6180C86D2F79BB19E1542A2DF8C64E0B786C29CBD6B1
TrID 74.6% (.EXE) Inno Setup installer (109740/4/30)
9.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
7.1% (.EXE) Win64 Executable (generic) (10523/12/4)
3.0% (.EXE) Win32 Executable (generic) (4505/5/1)
1.4% (.EXE) Win16/32 Executable Delphi generic (2072/23)
File icon (PE):PE icon
dhash icon 1000000000000000 (1 x SystemBC)
Reporter JAMESWT_WT
Tags:46-151-24-25-8000 exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
304
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
doc-235.exe
Verdict:
Malicious activity
Analysis date:
2023-09-22 16:59:25 UTC
Tags:
loader
Link:
https://app.any.run/tasks/b49304c1-a8fe-4200-92bc-d6d7f3ef6c14

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/450670/
Detection(s):
PUA.Win.Malware.Speedingupmypc-6718419-0
Create hunting rule

SecuriteInfo.com.Adware.Siggen.31863.24335.23560.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Restart of the analyzed sample
Searching for synchronization primitives
Creating a file
DNS request
Sending an HTTP GET request
Enabling the 'hidden' option for recently created files
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Running batch commands
Launching a tool to kill processes
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control installer lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/650dc79f34be449f0118a204/reports/10eed1f2-6ccc-4f96-9a59-3b308b4d496b/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_90%
Link:
https://www.hybrid-analysis.com/sample/36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/c2646df2-275d-4983-b246-0ae4c67a8051
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1313057
Signature
Antivirus detection for URL or domain
Contains functionality to modify clipboard data
Snort IDS alert for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1313057 Sample: doc-235.exe Startdate: 22/09/2023 Architecture: WINDOWS Score: 60 59 Snort IDS alert for network traffic 2->59 61 Antivirus detection for URL or domain 2->61 10 doc-235.exe 2 2->10         started        13 meltdown.exe 2->13         started        process3 file4 47 C:\Users\user\AppData\Local\...\doc-235.tmp, PE32 10->47 dropped 15 doc-235.tmp 3 6 10->15         started        process5 file6 49 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 15->49 dropped 51 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 15->51 dropped 53 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 15->53 dropped 18 doc-235.exe 2 15->18         started        process7 file8 37 C:\Users\user\AppData\Local\...\doc-235.tmp, PE32 18->37 dropped 21 doc-235.tmp 3 18 18->21         started        process9 dnsIp10 55 alaneade.com 95.154.236.16, 49716, 80 IOMART-ASGB United Kingdom 21->55 39 C:\Uranium-235\meltdown.exe, PE32 21->39 dropped 41 C:\Users\user\AppData\Local\Temp\...\idp.dll, PE32 21->41 dropped 43 C:\Users\user\AppData\Local\...\_shfoldr.dll, PE32 21->43 dropped 45 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 21->45 dropped 25 meltdown.exe 21->25         started        29 taskkill.exe 1 21->29         started        31 cmd.exe 1 21->31         started        file11 process12 dnsIp13 57 87.251.67.84, 49717, 49718, 49719 WELLWEBNL Russian Federation 25->57 63 Contains functionality to modify clipboard data 25->63 33 conhost.exe 29->33         started        35 conhost.exe 31->35         started        signatures14 process15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893/
Threat name:
Win32.Dropper.Malgent
Create hunting rule
Status:
Malicious
First seen:
2023-09-22 15:15:13 UTC
File Type:
PE (Exe)
Extracted files:
5
AV detection:
13 of 37 (35.14%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g376hwfawi6ofvvpcwgespnpdwxwmz5eysynjjhkaf55id3urcjq._file
Verdict:
unknown
Similar samples:
58511975e989a92826ee57cd50db6b59f508b3166d13957ac42c6754433dbfd7
615beea238930be9e92faf8e7394d59d65000beb9728bb8b38f6b31c83e435e8
6a302cdb1efa324f9fa2688866f25809ece99319f1ba3025abd50b757a17ddad
a3664504a50fcff0a0124780447f19c6073e04323782bb653de8640ca3f34f9b
a4f95464eccef0c4da2d48481ef8b1006a6ed0918fb421db63c793e1001bbeda
af1679585c261a5a4490b7848e65d45b6bc030fa124e75cccc2ac28e615d041e
b56c9109fdb9e8d8853fa536f3cdea9528a8a53493d3f3dc9f49243e30ed6be5
df7049b8c4d704376be3920232b1ba6b2c8cf2ff0f9cf3bf22f6d89c1c9515dc
e6447686ab68ede1a7b92ddc98b7e90ccf64d48876ace4b91cc45ea2437cc67c
+ 14 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/230922-vgtygsbc72/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Drops startup file
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Unpacked files
SH256 hash:
a7e37f5314834b163fa21557e61c13c0f202fd64d3c0e46e6c90d2d02e033aec
MD5 hash:
6faec01bf7a3d7f5c5dee2e6e3143a58
SHA1 hash:
603a36f817cab5574e58ab279379e5c112e5fb37
Link:
https://www.unpac.me/results/886f7c63-4174-4e29-b73f-c80f98629480/
SH256 hash:
44b8e6a310564338968158a1ed88c8535dece20acb06c5e22d87953c261dfed0
MD5 hash:
9c8886759e736d3f27674e0fff63d40a
SHA1 hash:
ceff6a7b106c3262d9e8496d2ab319821b100541
Link:
https://www.unpac.me/results/886f7c63-4174-4e29-b73f-c80f98629480/
SH256 hash:
bd716e0bd9d5b924e95db83c0e58653d8466f600fedbb1bd4513f2c4859bb51d
MD5 hash:
b1b79e7b4215cd739aa415cc5c7b023b
SHA1 hash:
60d893ef8ef07149729f1e1f4a693c1dd6c478a9
Link:
https://www.unpac.me/results/886f7c63-4174-4e29-b73f-c80f98629480/
SH256 hash:
36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893
MD5 hash:
ace147cef2116853ecc46a2033dd6428
SHA1 hash:
71dd40687f503c72b9a5a4051ed61b523d8f98b5
Link:
https://www.unpac.me/results/886f7c63-4174-4e29-b73f-c80f98629480/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 36ffe3d8a0b23ce2d6af158c493daf1daf6667a4c4b0d4a4ea017bd40f748893

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2713301/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/450670/

Comments