MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f2c9d22d533b55ac0d31e3a435c8a9b27cf1eb28d5ae02ab95887df21737afa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f2c9d22d533b55ac0d31e3a435c8a9b27cf1eb28d5ae02ab95887df21737afa
SHA3-384 hash: 2113e80124d604708d11846bcefb2beea8adb1d65ab2400be12256b0d9e648d901f87d994b584c3cf793bb129831cb61
SHA1 hash: 867f8a6647de725e8f77195948c0dec18500dd4d
MD5 hash: 05eda6c1568325e63a9a9ad3bd129f93
humanhash: beryllium-echo-happy-johnny
File name:SecuriteInfo.com.Win32.Application.OpenCandy.R.19320.29583
Download: download sample
File size:399'224 bytes
First seen:2022-11-23 15:34:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6391ab125edf3fb05a3d755299103e30
ssdeep 12288:Cy6+zAaK3ibG1V6ksIv1hcGFRGimtwi6roS70:CxmAaKUDI95FRGimRw0
Threatray 2 similar samples on MalwareBazaar
TLSH T1CC841246AA88DA81C4CDE970D19799F831A09D16FF0803FB19943D1AFEF775B0A0E5B4
TrID 31.5% (.EXE) UPX compressed Win32 Executable (27066/9/6)
30.9% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
19.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
5.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 8e0f6d4dcd391b12 (1 x Adware.InstallCore)
Reporter SecuriteInfoCom
Tags:exe signed

Code Signing Certificate

Organisation:BitTorrent Inc
Issuer:VeriSign Class 3 Code Signing 2009-2 CA
Algorithm:sha1WithRSAEncryption
Valid from:2010-06-21T00:00:00Z
Valid to:2013-07-26T23:59:59Z
Serial number: 36bc30562a650afaa5ad101ecd643ab4
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 2a5b779c89de4a7f2a8f07153a699ef37ec6d057022f6f279ad5db415511f2f3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
utorrent.exe
Verdict:
No threats detected
Analysis date:
2019-10-24 20:17:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6a795858-879c-4b37-998a-80469b8395a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/337716/
Detection(s):
SecuriteInfo.com.Win32.Application.OpenCandy.R.19320.29583.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Сreating synchronization primitives
Creating a window
Searching for the window
DNS request
Sending an HTTP GET request
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/637e3daa5be128ac718e84ca/reports/099c80ce-3c8b-459e-9a5d-469a53b8a813/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/094af955-8f56-4cc8-8741-b1d924f3a639
Result
Threat name:
Unknown
Detection:
suspicious
Classification:
evad
Score:
36 / 100
Link:
https://www.joesandbox.com/analysis/1119855
Signature
Delayed program exit found
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f2c9d22d533b55ac0d31e3a435c8a9b27cf1eb28d5ae02ab95887df21737afa/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=r4wj2iwvgo2vvqgtdy5egxektmt46hvsrvnoakvzlcd56iltpl5a._file
Verdict:
unknown
Similar samples:
de1ae614a8a926b44989594d2bd4615c14700e575662d7c4689789d6b228f79e
Result
Malware family:
n/a
Score:
  8/10
Tags:
evasion upx
Link:
https://tria.ge/reports/221123-s1c3zafg6x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Identifies Wine through registry keys
UPX packed file
Unpacked files
SH256 hash:
1bbca0c947d6bc4687b0582e9171377e752893c4aba9aa9650881ff7358db353
MD5 hash:
d21784ae138bbd1a663f1a9f94fdc76e
SHA1 hash:
e8d8408533dc8879b71b4b04f51ef27a15fe80eb
Link:
https://www.unpac.me/results/a90e395d-4b20-48d1-8c73-d50f66495d13/
SH256 hash:
8f2c9d22d533b55ac0d31e3a435c8a9b27cf1eb28d5ae02ab95887df21737afa
MD5 hash:
05eda6c1568325e63a9a9ad3bd129f93
SHA1 hash:
867f8a6647de725e8f77195948c0dec18500dd4d
Link:
https://www.unpac.me/results/a90e395d-4b20-48d1-8c73-d50f66495d13/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8f2c9d22d533b55ac0d31e3a435c8a9b27cf1eb28d5ae02ab95887df21737afa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/337716/

Comments