MalwareBazaar Database
".$row['signature'].""; $signature_p = $signature; $signature_p .= "\n
";
}
else {
$signature = "n/a";
$signature_p = $signature;
}
// Last seen
$last_seen = 'Never';
if($row['last_seen']) {
$last_seen = $row['last_seen']." UTC";
}
// Reporter
//$reporter = "@".$row['screen_name']."";
$reporter = get_avatar_link_png($row['fk_user_id']);
if($row['anonymous']) {
$reporter = "Anonymous";
}
// Tags
$ptags = '';
if($row['tags']) {
$tags = explode(',', $row['tags']);
foreach ($tags as &$tag) {
list($tag,$color,$malpedia) = explode('|', $tag);
if($malpedia) {
$ptags .= "$tag ";
}
else {
$ptags .= "$tag ";
}
}
}
// Count intel + load intel data (vendors)
//////////////////////////////////////////////////
$icnt = 0;
$itxt = 'Intelligence';
// OP#2136 Phase 4 — sample-page intel-fragment cache (include/page_cache.php)
$pcm = defined('SAMPLE_PAGE_CACHE_MODE') ? SAMPLE_PAGE_CACHE_MODE : 'off';
$pc_keys = array('acce_data','anyrun_data','cape_data','clamav_data','cyberf_data','bitdam_data','vxcube_data','docguard_data','dragonfly_data','filescanio_data','elfdigest_data','hybrid_analysis_data','inlyse_data','incinerator_data','intezer_data','kaspersky_data','kunai_data','malprob_data','malvare_data','mwdb_data','neiki_data','rl_data','jb_data','hbl_data','triage_data','threatzone_data','yoroi_data','vmray_data','vt_data','tr_data','um_data','icnt');
// public variant only: the abuse_ch admin renders VT live (session-gated below), never cached
$pc_eligible = ($pcm !== 'off') && function_exists('page_cache_get') && !(isset($_SESSION['auth_screen_name']) && $_SESSION['auth_screen_name'] === 'abuse_ch');
$pc_hit = false;
if ($pc_eligible && $pcm === 'on') {
$pc_c = page_cache_get($row['sha256_hash']);
if (is_array($pc_c) && !array_diff($pc_keys, array_keys($pc_c))) { extract($pc_c); page_cache_stat('hit'); $pc_hit = true; }
}
if (!$pc_hit) {
if ($pc_eligible && $pcm === 'on') { page_cache_stat('miss'); }
list($icnt, $acce_data) = acce_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $anyrun_data) = anyrun_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $cape_data) = cape_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $clamav_data) = clamav_intel_v2($icnt, $row['sha256_hash'], $row['clamav_ts']);
list($icnt, $cyberf_data) = cyberf_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $bitdam_data) = bitdam_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $vxcube_data) = vxcube_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $docguard_data) = docguard_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $dragonfly_data) = dragonfly_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $filescanio_data) = filescanio_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $elfdigest_data) = elfdigest_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $hybrid_analysis_data) = hybrid_analysis_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $inlyse_data) = inlyse_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $incinerator_data) = incinerator_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $intezer_data) = intezer_intel_v2($icnt, $row['sha256_hash']);
#list($icnt, $inquest_data) = inquest_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $kaspersky_data) = kaspersky_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $kunai_data) = kunai_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $malprob_data) = malprob_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $malvare_data) = malvare_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $mwdb_data) = mwdb_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $neiki_data) = neiki_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $rl_data) = rl_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $jb_data) = joebox_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $hbl_data) = hashbl_intel_v2($icnt, $row['sha256_hash'], $row['hashbl']);
list($icnt, $triage_data) = triage_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $threatzone_data) = threatzone_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $yoroi_data) = yoroi_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $vmray_data) = vmray_intel_v2($icnt, $row['sha256_hash']);
if(isset($_SESSION['auth_screen_name'])) {
if($_SESSION['auth_screen_name'] == 'abuse_ch') {
list($icnt, $vt_data) = vt_intel_v2($icnt, $row['vtts'], $row['vtpercent'], $row['vtlink'], $row['vtresult']);
}
}
if(!isset($vt_data)) {
$vt_data = '';
$tmp_data = '';
$tmp_data .= "\n";
$tmp_data .= "
\n";
// Generate card header
$vt_data .= "Please note that we are no longer able to provide a coverage score for Virus Total.
\n";
$tmp_data .= "\n";
$vt_data .= "
\n";
}
list($icnt, $tr_data) = threatray_intel_v2($icnt, $row['sha256_hash']);
list($icnt, $um_data) = unpacme_intel_v2($icnt, $row['sha256_hash']);
// OP#2136 Phase 4 — populate cache (shadow + on), public variant only
if ($pc_eligible && function_exists('page_cache_put')) {
$pc_payload = compact('acce_data','anyrun_data','cape_data','clamav_data','cyberf_data','bitdam_data','vxcube_data','docguard_data','dragonfly_data','filescanio_data','elfdigest_data','hybrid_analysis_data','inlyse_data','incinerator_data','intezer_data','kaspersky_data','kunai_data','malprob_data','malvare_data','mwdb_data','neiki_data','rl_data','jb_data','hbl_data','triage_data','threatzone_data','yoroi_data','vmray_data','vt_data','tr_data','um_data','icnt');
if ($pcm === 'shadow') {
$pc_prev = page_cache_get($row['sha256_hash']);
if ($pc_prev === false) { page_cache_stat('miss'); }
elseif (serialize($pc_prev) === serialize($pc_payload)) { page_cache_stat('hit'); }
else { page_cache_stat('differs'); }
}
page_cache_put($row['sha256_hash'], $pc_payload, function_exists('page_cache_ttl_for') ? page_cache_ttl_for($row['first_seen']) : null);
}
}
// Count file information (context)
$fcnt = 'File information';
$fi = mysqli_query($conn, "SELECT count(id) AS fcnt FROM tbl_context WHERE fk_sha256 = '".validateinput($sha256_hash)."' AND context != 'comment'");
$frow = mysqli_fetch_array($fi, MYSQLI_ASSOC);
// Generate nav
if($icnt != 0) {
$itxt = "Intelligence $icnt";
}
// Count YARA matches
//////////////////////////////////////////////////
$ycnt = 'YARA';
$y1 = mysqli_query($conn, "SELECT count(id) AS ycnt FROM tbl_procdumps_yara WHERE fk_sha256_hash = '".validateinput($sha256_hash)."' AND (tlp = 'WHITE' OR tlp IS NULL or tlp = '')");
$y2 = mysqli_query($conn, "SELECT count(p.id) AS ycnt FROM tbl_extracted_files AS e INNER JOIN tbl_procdumps_yara AS p WHERE e.fk_sha256_hash = '".validateinput($sha256_hash)."' AND (p.fk_sha256_hash = ext_sha256_hash OR p.fk_sha256_hash = pumped_sha256_hash)");
$y1 = mysqli_fetch_array($y1, MYSQLI_ASSOC);
$y2 = mysqli_fetch_array($y2, MYSQLI_ASSOC);
$ycnt = $y1['ycnt']+$y2['ycnt'];
if($ycnt != '0') {
$ycnt = "YARA $ycnt";
}
else {
$ycnt = 'YARA';
}
// IOCs
//////////////////////////////////////////////////
$ioccnt = 'IOCs';
$co = mysqli_query($conn, "SELECT count(id) AS icnt FROM tbl_threatfox_iocs WHERE fk_sha256_hash = '".validateinput($sha256_hash)."'");
$crow = mysqli_fetch_array($co, MYSQLI_ASSOC);
if($crow['icnt'] != '0') {
$ioccnt = "IOCs ".$crow['icnt']."";
}
// Count comments
//////////////////////////////////////////////////
$ccnt = 'Comments';
$co = mysqli_query($conn, "SELECT count(id) AS ccnt FROM tbl_comments WHERE fk_sha256_hash = '".validateinput($sha256_hash)."' AND removed = '0'");
$crow = mysqli_fetch_array($co, MYSQLI_ASSOC);
if($crow['ccnt'] != '0') {
$ccnt = "Comments ".$crow['ccnt']."";
}
?>
\n";
$vt_data .= "\n";
$vt_data .= "
\n";
// Generate card body
$vt_data .= "\n";
// Open grid
$vt_data .= "
\n";
$vt_data .= "\n";
// Grid body
$vt_data .= $tmp_data;
$vt_data .= "
\n";
// Close card
$vt_data .= "You are currently viewing the MalwareBazaar entry for SHA256 . While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
| SHA256 hash: | |
|---|---|
| MD5 hash: | |
| File name: | |
| Download: | download sample |
| Signature | |
| File size: | bytes |
| First seen: | UTC |
| Last seen: | |
| File type: | |
| MIME type: | |
| Note: | This file is a password protected archive. The password is: |
| Reporter | |
| Tags: |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| https://threatfox.abuse.ch/ioc// |
UPX packed
This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.
| File size (compressed) : | bytes |
|---|---|
| File size (de-compressed) : | bytes |
| Format: | |
| Unpacked file: |
UPX unpacked
This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.
| File size (compressed) : | bytes |
|---|---|
| File size (de-compressed) : | bytes |
| Format: | |
| Packed file: |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| $url | $last_hash | $msignature | $stags |
Intelligence
File Origin
# of uploads :
# of downloads :
Origin country :
File Archive Information
This file is a password protected archive. The password is:
This file archive contains file(s), sorted by their relevance:
100) || (preg_match("/^MS Windows 95 Internet shortcut text/", $arow['file_type']))) { array_push($interesting_files_arr, $arow); } else { array_push($irrelevant_files_arr, $arow); } } echo "\n";
// Relevant files
if(count($relevant_files_arr)) {
echo "
\n";
echo "
\n";
echo "\n";
echo "
\n";
echo "\n";
echo "
\n";
}
// Interesting files
if(count($interesting_files_arr)) {
echo "\n";
foreach ($relevant_files_arr as &$arow) {
?>
\n";
echo "
\n";
echo "| File name: | ".$arow['file_name']." | \n"; if($arow['is_pumped']) { echo "
|---|---|
| Pumped file | This file is pumped. MalwareBazaar has de-pumped it. |
| File size: | ".number_format($arow['file_size'],0,'',"'")." bytes |
| SHA256 hash: | ".$arow['ext_sha256_hash']." |
| SHA256 hash: | ".$arow['ext_sha256_hash']." |
| MD5 hash: | ".$arow['ext_md5_hash']." |
| De-pumped file size: | ".number_format($arow['pumped_file_size'],0,'',"'")." bytes (Vs. original size of ".number_format($arow['file_size'],0,'',"'")." bytes) |
| De-pumped SHA256 hash: | ".$arow['pumped_sha256_hash']." |
| De-pumped SHA256 hash: | ".$arow['pumped_sha256_hash']." |
| De-pumped MD5 hash: | ".$arow['pumped_md5_hash']." |
| MIME type: | ".$arow['file_type_mime']." |
| Signature | $signature |
\n";
echo "
\n";
echo "\n";
?>
\n";
echo "\n";
echo "
\n";
echo "\n";
echo "
\n";
}
// Irrelevant files
if(count($irrelevant_files_arr)) {
echo "\n";
foreach ($interesting_files_arr as &$arow) {
?>
\n";
echo "
\n";
echo "| File name: | ".$arow['file_name']." | \n"; if($arow['is_pumped']) { echo "
|---|---|
| Pumped file | This file is pumped. MalwareBazaar has de-pumped it. |
| File size: | ".number_format($arow['file_size'],0,'',"'")." bytes |
| SHA256 hash: | ".$arow['ext_sha256_hash']." |
| SHA256 hash: | ".$arow['ext_sha256_hash']." |
| MD5 hash: | ".$arow['ext_md5_hash']." |
| De-pumped file size: | ".number_format($arow['pumped_file_size'],0,'',"'")." bytes (Vs. original size of ".number_format($arow['file_size'],0,'',"'")." bytes) |
| De-pumped SHA256 hash: | ".$arow['pumped_sha256_hash']." |
| De-pumped SHA256 hash: | ".$arow['pumped_sha256_hash']." |
| De-pumped MD5 hash: | ".$arow['pumped_md5_hash']." |
| MIME type: | ".$arow['file_type_mime']." |
| Signature | ".$arow['signature']." |
\n";
echo "
\n";
}
?>
\n";
echo "\n";
echo "
\n";
echo "\n";
echo "
\n";
}
echo "\n";
foreach ($irrelevant_files_arr as &$arow) {
?>
\n";
echo "
\n";
echo "| File name: | ".$arow['file_name']." | \n"; if($arow['is_pumped']) { echo "
|---|---|
| Pumped file | This file is pumped. MalwareBazaar has de-pumped it. |
| File size: | ".number_format($arow['file_size'],0,'',"'")." bytes |
| SHA256 hash: | ".$arow['ext_sha256_hash']." |
| MD5 hash: | ".$arow['ext_md5_hash']." |
| De-pumped file size: | ".number_format($arow['pumped_file_size'],0,'',"'")." bytes (Vs. original size of ".number_format($arow['file_size'],0,'',"'")." bytes) |
| De-pumped SHA256 hash: | ".$arow['pumped_sha256_hash']." |
| De-pumped MD5 hash: | ".$arow['pumped_md5_hash']." |
| MIME type: | ".$arow['file_type_mime']." |
| Signature | ".$arow['signature']." |
\n";
echo "
\n";
echo "Vendor Threat Intelligence
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No records found
Comments
\n"; show_comments($sha256_hash); echo "