MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4
SHA3-384 hash: 6d715d1d984e11d14565d1acd2f361f0e12b06ab416506545cead971ee701cf013ec006461a1d89de32234d87e952c87
SHA1 hash: 1ab6ce5d5db05d0eecd23964f4178acb7fda2c7d
MD5 hash: 3bc33ba8ae07c650f43882fd2c61727f
humanhash: papa-apart-lithium-nitrogen
File name:SecuriteInfo.com.not-a-virus.AdWare.AdRotator.6223.5499
Download: download sample
File size:309'248 bytes
First seen:2023-09-18 18:42:28 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 631e8374d8de0818711f5a62bfeb8157
ssdeep 6144:B2zBHNhI966AGkAjOpoaY7TAAY27yZniIms+QTfxj6:8zB7q6xGJOpqnRypiI396
Threatray 1'974 similar samples on MalwareBazaar
TLSH T1EE6423327CA784D5C1252FB56E014BE05617E6F62DB8AF9B20D7A3512CDB9D1AF83230
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter SecuriteInfoCom
Tags:dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
282
Origin country :
FR FR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/449440/
Detection(s):
PUA.Win.Packer.AsprotectSke-3
Create hunting rule

PUA.Win.Packer.Asprotect-3
Create hunting rule

SecuriteInfo.com.not-a-virus.AdWare.AdRotator.6223.5499.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
aspack masquerade packed packed packed
Link:
https://www.filescan.io/uploads/65089a3f32ffdb7a7a0aa60f/reports/8c86777e-8be8-4446-b57b-24981355e5ad/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
30 / 100
Link:
https://www.joesandbox.com/analysis/1310287
Signature
PE file has nameless sections
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1310287 Sample: SecuriteInfo.com.not-a-viru... Startdate: 18/09/2023 Architecture: WINDOWS Score: 30 33 PE file has nameless sections 2->33 8 loaddll32.exe 1 2->8         started        process3 process4 10 rundll32.exe 8->10         started        12 cmd.exe 1 8->12         started        14 rundll32.exe 8->14         started        16 3 other processes 8->16 process5 18 WerFault.exe 9 10->18         started        21 rundll32.exe 12->21         started        23 WerFault.exe 2 9 14->23         started        25 WerFault.exe 3 9 16->25         started        27 WerFault.exe 16->27         started        dnsIp6 31 192.168.2.1 unknown unknown 18->31 29 WerFault.exe 24 12 21->29         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jxatger4dzagisvkx3wiolectw7kwykouujgvhfxpyrozoruwcsa._file
Verdict:
unknown
Similar samples:
0b8c38f7dc8e7a4f96bec4dc103d96492e80da2c74e85fad4d7bb87003270dc5
152ef5fcd0278e127c3df415018857f3aed0a748160032356786815ccbe870d5
16cb299292ac04c37e6eaf76f012ffe975d887bf607e5fae2261e14e3d6036e0
17c38669d795041d570650acdd426b0e0bb8b6019b0b9c43e55f368566ea20ac
261ec697b5a7215b436d0f6d16c64278ee88d1df97de3f777fc46198500c28c8
2e0dd590f38d998e1d95863bbcf32f33bf49c2365e3e66c69e6b3d0a482d5140
5ebeb6f62bdcdd09c794670801e5cb7d3d26139945e0c9f0e43c246033117885
78e27b98a7490de940c39948497894aba3d1408dd3ca2bbaa26430032b0a0bd6
d4324b0771d25b097db5e332d13a0a6b62ef6e41ea74d65ca9f25f5a9d6b06bd
d816c7ccdb90ec7d80aa1700a5133bdfa368e10f6d634bb3c94949feaa99fee9
+ 1'964 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
aspackv2
Link:
https://tria.ge/reports/230918-xcw86aec32/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4
MD5 hash:
3bc33ba8ae07c650f43882fd2c61727f
SHA1 hash:
1ab6ce5d5db05d0eecd23964f4178acb7fda2c7d
Link:
https://www.unpac.me/results/b182540c-bd93-4c64-a5e4-f87ee9ef825c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4dc133123c1e40644aaabeec872c829dbeab614ea5126a9cb77e22ecba34b0a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ASPackv212AlexeySolodovnikov
Create hunting rule
Author:malware-lu
Rule name:ASProtectV2XDLLAlexeySolodovnikov
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/449440/

Comments