MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64
SHA3-384 hash: 1f8b68f47d76c14d751cc7ce65b9ddfae98b6ab36aa2ff46c0325ed15252a62c69b5dcd1b61fa2f19653312fbf27b201
SHA1 hash: e8163950316bbf2d221d653e6f42e2ae55115ef7
MD5 hash: 3f3c313f5d93339ed2147648eb61492c
humanhash: kentucky-carbon-yellow-island
File name:KnightOnLine.exe
Download: download sample
File size:10'169'192 bytes
First seen:2025-02-16 00:37:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8aa3eb363558e1bdc6073a130d6c5f2b
ssdeep 196608:wR4zI4lHda5D8STXajfMAjCmcMC7oofFy8jU2ltAublSL:q4zI4lg5wIXajfMAjTAfFnU+AublM
TLSH T1C1A6338A5E10C35FE880EE3CC1D6BF3D125E5721F3F97A04B928A0B50A59E16976BF44
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
File icon (PE):PE icon
dhash icon 993175b4b8f2c625
Reporter derappa32
Tags:exe signed

Code Signing Certificate

Organisation:MYC DANIŞMANLIK GRUP İLETİŞİM SATIŞ TİCARET LTD. ŞTİ.
Issuer:GlobalSign GCC R45 EV CodeSigning CA 2020
Algorithm:sha256WithRSAEncryption
Valid from:2023-10-20T13:02:17Z
Valid to:2026-10-08T12:35:01Z
Serial number: 7174ed4202b5eb1e75af1eb1
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 0e4d3e5ae9b2ff6d52eb7f38550587cd7ac7384d788e6321492a17a309c0655d
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
585
Origin country :
BG BG
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
KnightOnLine.exe
Verdict:
No threats detected
Analysis date:
2025-02-16 00:39:41 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e086f2d5-c589-4d85-9775-8ba7b747b55a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67b133f4a0fd713c335b0d36
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ce089002-449d-4737-8f25-9715c27f1a7a
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/1616130
Signature
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Score:
97%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcqnd7m3kw75lndpgue3hr3q7qmdft5iqpgbp2b5zch3ea5tpnsa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery themida
Link:
https://tria.ge/reports/250216-aylyzsspcm/
Behaviour
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Themida packer
Downloads MZ/PE file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5fedc65b-0c79-47af-acbc-0ddef7fbde67
Unpacked files
SH256 hash:
58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64
MD5 hash:
3f3c313f5d93339ed2147648eb61492c
SHA1 hash:
e8163950316bbf2d221d653e6f42e2ae55115ef7
Link:
https://www.unpac.me/results/16d6b0db-d27e-443e-83a0-b675befc706f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/58a0d1fd9b55bfd5b46f3509b3c770fc1832cfa883cc17e83dc88fb203b37b64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:AlternativesExample1
Create hunting rule
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediaavifil32.dll::AVIFileRelease
winmm.dll::mmioSeek
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA

Comments