MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 39cbdf74922f664235947e2063c96bed4d054238b838e97b23dfccf3a0234f0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 39cbdf74922f664235947e2063c96bed4d054238b838e97b23dfccf3a0234f0a |
|---|---|
| SHA3-384 hash: | eb72af3b4cb14d0980ddfefda50a2332aeff3c3c01ae887bfc1c6925b8d5b8cf37996fce1646eff87da43df793cbdc91 |
| SHA1 hash: | 28ec97d9d271c5fd953aa9682b5600fad099fe86 |
| MD5 hash: | fa4ad19f7aefb5fbbcaff5106b4e6e92 |
| humanhash: | saturn-stairway-cardinal-angel |
| File name: | SecuriteInfo.com.FileRepMalware.7702.20668 |
| Download: | download sample |
| File size: | 11'015'831 bytes |
| First seen: | 2023-11-28 10:18:22 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1f2702872592229d2f4cb1162cfbc55b (9 x STRRAT) |
| ssdeep | 196608:qxAVcVB/Yv2XsiufClhIbCpsMXJRisuTKTLzo+jLGxUMxpW5o/dRe:qxA0wv2KfClhlJJEsuTIVjMU15o6 |
| TLSH | T161B6F117ADB8CC6CC9A394331092C397D20AE14DAE09DB9F13B11545CEF496B5B12BEE |
| TrID | 43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.2% (.EXE) Win32 Executable (generic) (4505/5/1) |
| dhash icon | e88e3371552b8ed8 |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
315
Origin country :
FRVendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Launching a process
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% directory
Gathering data
Verdict:
Suspicious
Threat level:
5/10
Confidence:
89%
Tags:
anti-debug anti-vm overlay packed
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
98%
Verdict:
Malware
File Type:
PE
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2023-11-21 13:25:21 UTC
File Type:
PE (Exe)
Extracted files:
5077
AV detection:
5 of 23 (21.74%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery
Behaviour
Modifies Internet Explorer settings
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies file permissions
Unpacked files
SH256 hash:
39cbdf74922f664235947e2063c96bed4d054238b838e97b23dfccf3a0234f0a
MD5 hash:
fa4ad19f7aefb5fbbcaff5106b4e6e92
SHA1 hash:
28ec97d9d271c5fd953aa9682b5600fad099fe86
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.63
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 39cbdf74922f664235947e2063c96bed4d054238b838e97b23dfccf3a0234f0a
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.