MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 46878cf16c919445a9e5ada3ff03ca3465c03323a3e8b31c2de38eae1c9259e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 46878cf16c919445a9e5ada3ff03ca3465c03323a3e8b31c2de38eae1c9259e4 |
|---|---|
| SHA3-384 hash: | 87175ca974dbf5a8139154ee11a57dc7da1f867c97307c0a7e7696dfe1dfc8fa498079e0816bcda5ae9e0cfd2d0fe3fc |
| SHA1 hash: | 9cd5915fefab0bf1f22349505f3b1b61492a8d9c |
| MD5 hash: | b9ee938be15921b1a372bd97372a9c31 |
| humanhash: | mockingbird-equal-fruit-texas |
| File name: | 46878cf16c919445a9e5ada3ff03ca3465c03323a3e8b31c2de38eae1c9259e4 |
| Download: | download sample |
| File size: | 3'979'776 bytes |
| First seen: | 2021-10-23 15:43:02 UTC |
| Last seen: | 2021-10-23 17:17:25 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7288d8890a31b99396e4c87c90d9ddd2 |
| ssdeep | 49152:eUTjlTzQEqr/efOJ/X0qOrJ1mNJnROYcVJpq40pOyPZeC5myyNegWRM2Gh//xD69:eUT1zQLSgXIeRRvp40EyPZTdyWsDH2 |
| TLSH | T1D906126752790149E5E8CD3DC637BFA573F606378B81A8BD85DE69C222120E0E293F53 |
| Reporter |  ZawadiDone |
| Tags: | exe Macaw WastedLocker |
Intelligence
File Origin
# of uploads :
2
# of downloads :
1'237
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
46878cf16c.exe
Verdict:
No threats detected
Analysis date:
2021-10-22 16:20:57 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
68 / 100
Signature
Antivirus / Scanner detection for submitted sample
Found detection on Joe Sandbox Cloud Basic with higher score
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.Macaw
Status:
Malicious
First seen:
2021-10-16 00:59:42 UTC
AV detection:
28 of 45 (62.22%)
Threat level:
5/5
Verdict:
malicious
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
46878cf16c919445a9e5ada3ff03ca3465c03323a3e8b31c2de38eae1c9259e4
MD5 hash:
b9ee938be15921b1a372bd97372a9c31
SHA1 hash:
9cd5915fefab0bf1f22349505f3b1b61492a8d9c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 46878cf16c919445a9e5ada3ff03ca3465c03323a3e8b31c2de38eae1c9259e4
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.