🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39c531db99d46a4b3906a41e6e1afdb2523106c795b11eecaf75bc3a1fbff57b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39c531db99d46a4b3906a41e6e1afdb2523106c795b11eecaf75bc3a1fbff57b
SHA3-384 hash: f4b2c8941a23ecf67c8ae8c9f218fc0831303202d8a665789c774256ce9bcf83b2f08667b6474c6146023cfb9bd46809
SHA1 hash: 21ebe48bb2d22961344641a24d83655744406ecc
MD5 hash: c5efb5cdbb39c9d23bf2d4f0a756a728
humanhash: lion-sad-lactose-king
File name:SecuriteInfo.com.Win32.Packed.FlyStudio.AApotentiallyunwanted.2342
Download: download sample
File size:2'014'208 bytes
First seen:2020-06-08 23:37:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6846a114f7612c4d237f313f6872b7a8
ssdeep 49152:hlIWGSzohCl2rjzM1kNx5ymDwcqHBVaCorwP0qlvQRW:hlIWzzKM2rjzEsFwLHaF0PYRW
Threatray 28 similar samples on MalwareBazaar
TLSH 8A9533A1F9639CC2E0A429723A6A6E540913F12CDF50C1B17E8ED15298ADCF44EB4F65
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Softpulse-6693799-0
Create hunting rule

PUA.Win.Downloader.Firseria-6870500-0
Create hunting rule

PUA.Win.Packer.PECompact-2
Create hunting rule

PUA.Win.Packer.Pecompact-69
Create hunting rule

PUA.Win.Packer.Pecompact-72
Create hunting rule

PUA.Win.Packer.Pecompact-74
Create hunting rule

PUA.Win.Packer.Pecompact-75
Create hunting rule

PUA.Win.Packer.PecompactHeuris-1
Create hunting rule

SecuriteInfo.com.Win32.Packed.FlyStudio.AApotentiallyunwanted.2342.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.PUA.FlyStudio
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 18:12:34 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  1/5
Verdict:
suspicious
Similar samples:
024a7ee33fb7e998cde95a0d0e4850022a8742e16544f8b1b32baf4b64644643
54cc3426c8ad3f2d39543a8157843620af7108ea419589cc6755e77a31b96047
5d31ded12c6a8943f96522d5353af0d3bbb9a5ee81cef07db1c14c7cc0f117c6
5fb20cca77d85fedf3653f24c8109d985c946955ad50ffd18bff9e33d64bc5ef
6575a80b5fa70f2b72b0c5270e4bf316efbdda166b73267a783ebe8a56f3cd1e
69cd9793d80b5e5d7f5bf377822dc573c84ef939ede4eedd892fd1b757435bff
9b6c23ee51101f9e2542bb697e7b218e0a57d51ac6b577998cba351581aa7491
aea1d064fb75706dd261f1097f91574050216410ce840e9c7523c46aca53c5f9
d73498e0aabb97375783af491aded66aa6710ba848247de3337f404fa02a35c0
fdafb44be84ea918c76a99f4c24c08fbe8de6648a4ad73614f77450aa2b43484
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-jskblgdp7j/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in System32 directory
JavaScript code in executable
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 39c531db99d46a4b3906a41e6e1afdb2523106c795b11eecaf75bc3a1fbff57b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/384150/
  
Delivery method
Distributed via web download

Comments