🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Conficker


Vendor detections: 13


Intelligence 13 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974
SHA3-384 hash: 9562e1015e969a3d96b4c326882bab0e4d5ca138b33d73d8b8615edcaed0a5d1934b706dd8446190e9a4a29269fc757f
SHA1 hash: 7b9891dfadc13d4a6820ed9b9ae00a0ba3de5064
MD5 hash: 67241ac88d798ccd90a6f49f481ac26c
humanhash: coffee-bacon-berlin-monkey
File name:jwgkvsq
Download: download sample
Signature Conficker
Create hunting rule
File size:154'652 bytes
First seen:2025-08-28 10:08:03 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 2b84b771869c4a91d08f18490c535278 (1 x Conficker)
ssdeep 3072:j8Z/N1mEbHgQ92bEj9lEOm6nM5BFVUHmfXM11O:wAEDv92b8lE75Omy1O
Threatray 569 similar samples on MalwareBazaar
TLSH T188E31281FD391D4AD94AD93B08BD9BD341828430A8BDA29E45FDA3DA31700F49CE775B
TrID 34.7% (.EXE) UPX compressed Win32 Executable (27066/9/6)
34.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
8.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.7% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter JaffaCakes118
Tags:conficker dll

Intelligence

File Origin
# of uploads :
1
# of downloads :
215
Origin country :
GB GB
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24009/
Detection(s):
Win.Worm.Kido-243
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b02a9feb163e0ec182f826
Tags:
networm virus kido
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
conficker downadup evasive greyware kido networm overlay overlay packed packed packed packed upx
Link:
https://www.filescan.io/uploads/68b02aa339a6221faa72bc1b/reports/9cc6cd83-88f0-4eb5-95ef-5cc0c4517bf7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974
Verdict:
Malicious
File Type:
dll x32
First seen:
2010-07-26T02:23:00Z UTC
Last seen:
2010-07-26T02:23:00Z UTC
Hits:
~1000000
Detections:
BSS:Trojan.Win32.Bazon.a Net-Worm.Win32.Kido.ih HEUR:Worm.Win32.Generic HEUR:Trojan.Win32.Generic Trojan-Spy.Win32.Small.plg Trojan.Win32.Agent.dlrh
Link:
https://opentip.kaspersky.com/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b62a2c49-f7a3-4f8e-9bda-c6fd6246c0a0
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974/
Verdict:
Malicious
Threat:
Family.CONFICKER
Link:
https://tip.neiki.dev/file/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974
Threat name:
Win32.Worm.Conficker
Create hunting rule
Status:
Malicious
First seen:
2011-07-24 04:33:00 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
35 of 36 (97.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k2tvs6qi2qfsfdtlryxoopmhbd7xaujp55ncq6dypipjj62p3f2a._file
Verdict:
malicious
Label(s):
conficker
Create hunting rule
Similar samples:
15c4f381e82e4d4d24ddd1f3ca33cf16678933534da2e5c27f67ec7ece8b7509
Conficker
2fd3d4a53dba424e61cab4f1f7b2f6d02079e0d0f06ed91dcc9f5214b1ee174a
Conficker
31ee08e0aad9297988beb54957c0fa5bce2d9b1d0d2c16e4932e247c73c19348
Conficker
4fb3fb9750c68de93bee10692827f5630635ef39ed13a86dba52b9cd1e02280d
Conficker
6b023387ea48536d7900b1caff4c3568eb8761b55e0559b5680258bf28c55eec
Conficker
7fcf599838680e41a18f0790c454f3b96b59d9c65878268bb137d2a520ac4d6a
Conficker
a6d472279fb47d3881bae4e241d50a96af105b40b82af5cb71ec8f4991bd22f7
Conficker
cb1ee7fa3edcc9795877868ad56cf32b9d6c3d95ea59d348e55c2b5caf87a180
Conficker
d8c44f8a58899360bf30a527082c917bae7b564db5f129f2517a5deb39ba9ff2
Conficker
e9b303f24082eaf87853558d2d427ad2eecc78acd538d37e1f4397d378b47c27
Conficker
error
Conficker
+ 559 additional samples on MalwareBazaar
Result
Malware family:
conficker
Create hunting rule
Score:
  10/10
Tags:
family:conficker adware defense_evasion discovery persistence spyware upx worm
Link:
https://tria.ge/reports/250828-l6fygszvbx/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
System Location Discovery: System Language Discovery
UPX packed file
Enumerates connected drives
Conficker
Conficker family
Detects Conficker worm
Modifies visibility of file extensions in Explorer
Modifies visibility of hidden/system files in Explorer
Unpacked files
SH256 hash:
56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974
MD5 hash:
67241ac88d798ccd90a6f49f481ac26c
SHA1 hash:
7b9891dfadc13d4a6820ed9b9ae00a0ba3de5064
Link:
https://www.unpac.me/results/e1b21240-7e09-4e58-953b-e47545429ba2/
SH256 hash:
1cd5082b466fa462f591d4d84e89dfd4c8347019c741a6e446e5e1a35b970bb2
MD5 hash:
8e408dd8fedd45fd01ff1fdebdca99dd
SHA1 hash:
9488c91647a00a3db9b4a9f9c2bc0681b3d39c93
Link:
https://www.unpac.me/results/e1b21240-7e09-4e58-953b-e47545429ba2/
SH256 hash:
aa0bbaecb678868e1e7f57c7ca9d61b608b3d788be490790eb1d148beadf4615
MD5 hash:
3291e1603715c47a23b60a8bf2ca73db
SHA1 hash:
41531fa6b5086e9150b57256efbcd47d7c05cd53
Link:
https://www.unpac.me/results/e1b21240-7e09-4e58-953b-e47545429ba2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:win_conficker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.conficker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Conficker

DLL dll 56a7597a08d40b228e6b8e2ee73d8708ff70512fef5a2878787a1e94fb4fd974

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/24009/

Comments