MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85
SHA3-384 hash:	bdcf61f86b6d73fa69f378b2f12ed3bbe39ab51c5b09bf935f51fa1473cfe5deb309c56e5c0c6508209c43d5fd8dcd80
SHA1 hash:	808183d9160a89ad3c8730d2b6b76803ca97f38f
MD5 hash:	00ced89a573ad1e1f96c94c763222e1e
humanhash:	salami-high-butter-carbon
File name:	HitPawInfo.exe
Download:	download sample
File size:	500'488 bytes
First seen:	2024-10-07 22:27:28 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fa6e002c2e83eeb736dfdd49eee0ec5b
ssdeep	12288:8NgbfebCK2Zc88TonN0jeidRntIYRRCQYffq+:ugbEjkc8ConiFztIwR92j
TLSH	T1EFB4127604F84D65D91A6235C680520BA438398CABD1D7DB83A5BC1ABF8E7D3A37D334
TrID	48.7% (.EXE) Win64 Executable (generic) (10523/12/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
File icon (PE):
dhash icon	1b64d298ccec7919
Reporter	PeterGabaldon
Tags:	exe gibbooc2.com remcos

Intelligence

File Origin

# of uploads :

# of downloads :

460

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Player reports algnet 07-10-2024 .pdf www.skype.com

Verdict:

Malicious activity

Analysis date:

2024-10-07 22:27:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f93ffb1f-1a55-4839-b7b4-7c0e03332e99

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67046074a69182ddbe5ccf67

Tags:

injection exploit

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin microsoft_visual_cc overlay packed shell32

Link:

https://www.filescan.io/uploads/670460724f53598f1492cad9/reports/0a3f1c12-ae02-4c48-a818-5b8cc96eaf34/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/f7cae5c0-2d40-41de-8415-c858454409fe

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1528531

Behaviour

Behavior Graph:

n/a

Score:

67%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7a32j6gpgy3kmdjs3h2kgh2dj5u7nqob7tovev3jor3qlchdkcq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/241007-2dpb6azflg/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/844001eb-2a6f-4c77-9eba-11909b46ac52

Unpacked files

SH256 hash:

5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

MD5 hash:

00ced89a573ad1e1f96c94c763222e1e

SHA1 hash:

808183d9160a89ad3c8730d2b6b76803ca97f38f

Link:

https://www.unpac.me/results/127ae3e9-a759-4242-ab27-aac8a84c0540/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Potentially_Signed_Digital_Certificate Create hunting rule
Author:	albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

exe be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715

exe 5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

(this sample)

Dropped by

SHA256 be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715

Dropped by

MD5 005245fcbca50a836235392c802198a8

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample