MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.FlyStudio


Vendor detections: 14


Intelligence 14 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a
SHA3-384 hash: 35801371b86ffec1c494767eff085653ec8e2a41b6fa262cb0c932af1646b81c073c3d2618d048f0c9230073f596f89e
SHA1 hash: 7f1ceaf1cf44ec1f7dc7c02d05afb0ca912ef9b8
MD5 hash: 43f621f9ce5ecfb51f1adc1d6f78e268
humanhash: music-robert-montana-hawaii
File name:43f621f9ce5ecfb51f1adc1d6f78e268.exe
Download: download sample
Signature Adware.FlyStudio
Create hunting rule
File size:4'968'448 bytes
First seen:2024-07-23 12:30:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6484a6f708fa37c8c0be3e0080079152 (3 x Adware.FlyStudio)
ssdeep 98304:96AFKfbHczuKUQlDEdDE3iSnArFqZVUzSnDYqdwkLcHHiC6t:8AFKfbHczuiAqmSjAS
Threatray 50 similar samples on MalwareBazaar
TLSH T179365B13E361C6E4E124003261E783345F34B6756C22AEABEB94EEF95D79671DB2231C
TrID 30.0% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
16.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
14.1% (.EXE) UPX compressed Win32 Executable (27066/9/6)
13.8% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
8.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
File icon (PE):PE icon
dhash icon 3070f0e871d0c028 (4 x Adware.FlyStudio)
Reporter abuse_ch
Tags:Adware.FlyStudio exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
353
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Upx-45
Create hunting rule

Win.Trojan.Flystudio-9943951-0
Create hunting rule

Win.Malware.Zusy-10030725-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669fa28ab302ab76f44865bc
Tags:
Network Static Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file
Enabling the 'hidden' option for recently created files
Searching for synchronization primitives
Connection attempt
Sending a custom TCP request
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
90%
Tags:
epmicrosoft_visual_cc keylogger lolbin microsoft_visual_cc packed shell32
Link:
https://www.filescan.io/uploads/669fa299cbb32227b6aaae74/reports/aa361c4e-d9e9-4b4d-919d-a2fd1908a796/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/52b3a5ed-f2dd-461e-9c00-46672dd84c59
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1479341
Signature
AI detected suspicious sample
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a/
Threat name:
Win32.Infostealer.Tinba
Create hunting rule
Status:
Malicious
First seen:
2024-07-23 12:31:14 UTC
File Type:
PE (Exe)
Extracted files:
139
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=khtynvxi3ddimtvametg4mm72ohqmjihk7thz5fojptxmmmt655a._file
Verdict:
malicious
Similar samples:
638d840d131eda4e2af96e320cebb35c9b3c660c94faa8f74d239daa1e2d3810
Adware.FlyStudio
6ff9db55858b84c4eed7dd8ae5221e8e56b72e98b9006c7bda7c38f7874d4f5b
Adware.FlyStudio
7ab4e089556c883f02ba5ad5de7ea80f078fb135c0bd4aaacfe2d44e1015b190
Adware.FlyStudio
da55548cedd837a70600d20d9670c0119e99f9d137c875d4e9e4ce00bd263183
Adware.FlyStudio
e5708bcb4d6968d7eead027bf58727779e46e2c6a8ae1f1c67650af7290d83b9
Adware.FlyStudio
f9e2e51e406e4e233d420360cc77f4299acd62f1ccfde1727bb28a8b93229593
Adware.FlyStudio
+ 40 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/240723-pp216szcmq/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
ACProtect 1.3x - 1.4x DLL software
Loads dropped DLL
UPX packed file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/64f59580-fa48-447b-a803-3f16f3b4deb4
Unpacked files
SH256 hash:
51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a
MD5 hash:
43f621f9ce5ecfb51f1adc1d6f78e268
SHA1 hash:
7f1ceaf1cf44ec1f7dc7c02d05afb0ca912ef9b8
Link:
https://www.unpac.me/results/02920da3-8815-4213-aaca-19d7ddcfa8bb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Hacktools_CN_Panda_andrew
Create hunting rule
Author:Florian Roth
Description:Disclosed hacktool set - file andrew.exe - sethc.exe Debugger backdoor
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:with_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the presence of an or several urls
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.FlyStudio

Executable exe 51e786d6e8d8c6864ea061266e319fd38f06250757e67cf4ae4be7763193f77a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2895457/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::midiOutPrepareHeader
WINMM.dll::midiOutReset
WINMM.dll::midiOutUnprepareHeader
WINMM.dll::midiStreamClose
WINMM.dll::midiStreamOpen
WINMM.dll::midiStreamOut
RAS_APIUses Remote AccessRASAPI32.dll::RasGetConnectStatusA
RASAPI32.dll::RasHangUpA
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WinExec
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateDirectoryA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::GetSystemDirectoryA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegQueryValueA
ADVAPI32.dll::RegSetValueExA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowA
USER32.dll::OpenClipboard
USER32.dll::PeekMessageA

Comments