MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa
SHA3-384 hash: 67122bf9d73836bfb9bad5086883de97668ea04ca7f7a0d9569630293216fb8c244ad007e517878ccf879f7d1a785c79
SHA1 hash: a362da7c64b38274720e43afa279f8832ff7d1c2
MD5 hash: 56d6a9c7f941b38a886dfcc41b7960bd
humanhash: leopard-diet-six-thirteen
File name:Simple Dll.dll
Download: download sample
File size:104'960 bytes
First seen:2024-07-31 12:10:01 UTC
Last seen:2024-07-31 12:24:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b0cb85ebf685b355ea9f7a09f3eca42c
ssdeep 384:ga7wez/uXHFCZBem2Wx6MN99Sjvb99SjvWpN:g0bz/QHFCTemFL9Sbh9Sb
TLSH T147A31E539AEC3DC7C038A3B077BB93D4D72EDD95A0A2C10E96D00295E9BD41779227D8
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon f0968ee8aae8e8b2 (13 x ValleyRAT, 9 x Urelas, 5 x HermeticWiper)
Reporter poppysec
Tags:apt dll Storm-1789


Avatar
poppysec
Second stage from npm package next-react-notify

Intelligence

File Origin
# of uploads :
2
# of downloads :
379
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Simple Dll.dll
Verdict:
No threats detected
Analysis date:
2024-07-31 12:13:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d082cffc-56a7-4dab-965b-db5aa962c820

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66aa299f037b02d0daecbe5b
Tags:
Static
Result
Verdict:
Clean
Maliciousness:
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/67b0279b-2caf-4e35-bdb6-c6608c3ae1cc
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1485328
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1485328 Sample: Simple Dll.dll.exe Startdate: 31/07/2024 Architecture: WINDOWS Score: 48 19 Multi AV Scanner detection for submitted file 2->19 7 loaddll64.exe 1 2->7         started        process3 process4 9 cmd.exe 1 7->9         started        11 conhost.exe 7->11         started        13 rundll32.exe 7->13         started        15 rundll32.exe 7->15         started        process5 17 rundll32.exe 9->17         started       
Score:
12%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iori7rnb5zdnudswtd7ni44afk3k6x4dem5zfb2ft3bob5rfb35a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240731-pb1wysxakg/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5dd54de1-c15f-4953-9193-2761ebb5f0e8
Unpacked files
SH256 hash:
43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa
MD5 hash:
56d6a9c7f941b38a886dfcc41b7960bd
SHA1 hash:
a362da7c64b38274720e43afa279f8832ff7d1c2
Link:
https://www.unpac.me/results/5d7e6de8-5e74-40a3-8590-2d38eb193c8e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CAS_Malware_Hunting
Create hunting rule
Author:Michael Reinprecht
Description:DEMO CAS YARA Rules for sample2.exe
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 43a28fc5a1ee46da0e5698fed473802ab6af5f83233b9287459ec2e0f6250efa

(this sample)

  
Link
https://stacklok.com/blog/north-korean-state-actors-exploit-open-source-supply-chain-via-malicious-npm-package
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
Reviews
IDCapabilitiesEvidence
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess

Comments