MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2
SHA3-384 hash: 0647acbb35d13ce90098483d7117b650eae0d464f94f6efb48e9d05bb4dddc2df3288565a43b1ebd2115fa98cab3ba5e
SHA1 hash: 2c4ff72e0f17af6dad7146a2f9de06e1187e0b69
MD5 hash: 4c6f64715df65201b347a48ac66d3daa
humanhash: august-music-table-ack
File name:414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2
Download: download sample
Signature n/a
File size:1'490'120 bytes
First seen:2020-03-23 18:47:11 UTC
Last seen:2020-03-30 07:07:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c0b56bf400b50c017c67f5287c8df2b0
ssdeep 24576:AcH4RyUdH474qoYqDDBfdcxVrGpw+yf2fJala9wth/j9O/1:jgh4sqoYiDge3o2xaASZMd
Threatray 15 similar samples on MalwareBazaar
TLSH 6E652321994375D6FB5906721BF8FEDAB82046AB2F3C42F1159409FA4E8C4D36C1AFD8
Reporter @Marco_Ramilli
Tags:exe

Code Signing Certificate

Organisation:IIYGGNPS
Issuer:IIYGGNPS
Algorithm:sha1WithRSA
Valid from:Dec 28 12:31:43 2018 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -6626612E5858DD5FBE05A30CCC1EE72D
Thumbprint Algorithm:SHA256
Thumbprint: 653E34E25EE58F1DB9BCFD1AAC55E82EC58531CC66A14EE45AC67D5D42F6556C
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence


File Origin
# of uploads :
4
# of downloads :
72
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 414bb1af4fbb618c4889d69144c7f66591c6e5294d0ab3b7ea8b774946977cf2

(this sample)

  
Delivery method
Distributed via web download

Comments