MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ad864876c4c4df25b6fdb4eddf7ff76c18bb7e5edb0e82b4049baaea26587fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ad864876c4c4df25b6fdb4eddf7ff76c18bb7e5edb0e82b4049baaea26587fe
SHA3-384 hash: 06b4fe1ecb272d5a7de7aaacd2748a34357b81cc398a064cf97e2b5ea2d9f7e3d55bc1e0fcee993658071739951b410f
SHA1 hash: ae4e01c1d94dfe645b7d854d6427a8bade0fbc50
MD5 hash: 3d0d6e31831fdd87478218a4f17d8168
humanhash: north-alanine-massachusetts-oklahoma
File name:DHL SHIPPING DOCUMENTS.exe
Download: download sample
File size:43'328 bytes
First seen:2022-11-03 07:48:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 29b61e5a552b3a9bc00953de1c93be41 (174 x Formbook, 82 x AgentTesla, 81 x Loki)
ssdeep 768:6jPxOddUbFatgWQIo31pJPv2NnQU04CagD1wDARjf+3+cSM5qyzm98Xzvqj1Ia:6jpUUbAtT7oF3vWQ+Gwl+cSMPmuqH
Threatray 1'056 similar samples on MalwareBazaar
TLSH T181139E7731D0C4F7E5A30A714AB7A776D2BBD6040125264B4BB04F7B6D722C7E90A193
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:DHL exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DHL SHIPPING DOCUMENTS.exe
Verdict:
Malicious activity
Analysis date:
2022-11-03 08:27:08 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/389c8759-5831-41ee-b909-18cc2139e37a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/327717/
Detection(s):
SecuriteInfo.com.Gen.Variant.Fragtor.158039.6419.24818.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a process from a recently created file
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/47820/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/63637270fe481257b8fc03f4/reports/6e7d20b4-a2a4-48f2-a9c2-376969dead06/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
LockBit Ransomware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b8756a61-7f48-44ee-95c0-278f9aee67d5
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1105096
Signature
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ad864876c4c4df25b6fdb4eddf7ff76c18bb7e5edb0e82b4049baaea26587fe/
Threat name:
Win32.Trojan.GenericML
Create hunting rule
Status:
Malicious
First seen:
2022-11-03 06:47:10 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
16 of 21 (76.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlmgjb3mjrg7ew3p3nhn3577o3ayxn7f5wyoqk2ajg5k5itfq77a._file
Verdict:
unknown
Similar samples:
09da53e995501bda431956e08c48092a4a15c3421ec5074f683521e2a570bf61
0e1e276f7acaa813b0eead4d2ff2da2d04bd93424619565ed866a1a3c82b7425
0e9cef4df6cee909e112ce177bdc735afa09d43cacb8614b282d9f18ef62cef9
194b21139e3a9a343c63617ad33ee48abdfa1566a4302a04b65df43888395400
2b3d32ba155e67989eb11a9cf80ca81dc5ebccd90e1589996cbeb613d445874c
c23c53452c3180e79ca639a79a2dc1ea8e3d8fbf4833e02e4ac02959dcfce486
dfaf97d53abf5a5beb3f87f6a427a0329d4916495de13c605c2dbd7084a7cafe
+ 1'046 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221103-jnnt9sfgg3/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/feb432e7-9493-476c-813d-8e1f81991a5a
Unpacked files
SH256 hash:
6ee179f1b0b898774b035d99db6206a5db472fb1d4cb501c45fff4736a7c168f
MD5 hash:
df455be2924ee36387221d8745a192c7
SHA1 hash:
ea8c6f8bd5f0608e2059d8a3b04911e8aed61889
Link:
https://www.unpac.me/results/547f361c-f193-4506-93ec-2f4991bb1b7d/
SH256 hash:
3ad864876c4c4df25b6fdb4eddf7ff76c18bb7e5edb0e82b4049baaea26587fe
MD5 hash:
3d0d6e31831fdd87478218a4f17d8168
SHA1 hash:
ae4e01c1d94dfe645b7d854d6427a8bade0fbc50
Link:
https://www.unpac.me/results/547f361c-f193-4506-93ec-2f4991bb1b7d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/3ad864876c4c4df25b6fdb4eddf7ff76c18bb7e5edb0e82b4049baaea26587fe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/327717/

Comments