MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 91317464f677d1408e609d2296203b84cebed70ebc9aec92b51734c52db5bb32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | 91317464f677d1408e609d2296203b84cebed70ebc9aec92b51734c52db5bb32 |
|---|---|
| SHA3-384 hash: | c961d4298dd528b9372e59482fa284307d9e043054b350f1370d5cc7965f9a1702d88b6698f08375b694bf0dab0fc1e7 |
| SHA1 hash: | eed899d2ae028a58bbb8bfb27c18282c26b2acee |
| MD5 hash: | 68aa4f34a072419ae905d1cde1f95657 |
| humanhash: | nuts-hamper-washington-fanta |
| File name: | Fund-Notifications-545pdf.exe |
| Download: | download sample |
| File size: | 5'497'856 bytes |
| First seen: | 2023-03-07 14:13:50 UTC |
| Last seen: | 2023-03-07 15:50:07 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger) |
| ssdeep | 24576:aSKuD4f2v9Y0Z8jmzN6epIou2dua0acpXXc0GoK1D4f2v9Y0Z8jmzN6epIou2duw:a2cIZ8h4OsoU1cIZ8h4OsoU |
| Threatray | 2'123 similar samples on MalwareBazaar |
| TLSH | T1AA461C292EFA402AB1B3EF555BD474BAEB5FBB633B1A445900C10B4606D3805EDC927F |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10523/12/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4505/5/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| File icon (PE): |  |
| dhash icon | d8dc888898a898b8 (6 x AgentTesla, 1 x XWorm) |
| Reporter |  0xToxin |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
226
Origin country :
ILVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Fund-Notifications-545pdf.exe
Verdict:
Malicious activity
Analysis date:
2023-03-07 14:14:32 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Creating a file
Сreating synchronization primitives
Creating a window
Sending a custom TCP request
Forced shutdown of a system process
Unauthorized injection to a system process
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Verdict:
Malicious
Labled as:
Win/malicious_confidence_90%
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Signature
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.Dothetuk
Status:
Malicious
First seen:
2023-03-07 14:19:05 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
17 of 25 (68.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 2'113 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Unpacked files
SH256 hash:
7311644c2eae36bda44bf70326184e62c19ea819c4ad6ee936016877c4a68aef
MD5 hash:
c7643a1068ecdbc862a8ff7133bc823a
SHA1 hash:
e10fa48940dbfdeaff274841bd4beeb0f7a59f20
SH256 hash:
b3ef5358fd472fb815b25ae19c8bd2b5a8ae5c23d1663817f4d43f4c8ea434e9
MD5 hash:
657869ead2c78a0abe392aba22f694c4
SHA1 hash:
4bd473e6d292b4226438c25bd98b3990a59c5489
SH256 hash:
573ab63918fbd92d271c0d8d4afd0217001042bdbc4a11862f36b9615c558452
MD5 hash:
a037d46b9aab9367d01a654bbd67cf5d
SHA1 hash:
19c8a0d47ca3bb54c3702164901ad3769007ff4a
SH256 hash:
4345d15dcca24277c7d1f60d1583ae1d58d029c9aeaecc76b13c5daf07ce48a3
MD5 hash:
64cf6f9f2af4fdb442807392ad8a21c2
SHA1 hash:
2effb6251c48e02518b3f9a1b7aa78f99726dc6a
SH256 hash:
4a89c192de3a21dccf0b1c1baef6ed74727ec51ae73122a24977cef171b5e924
MD5 hash:
9cb8121670660c0805d8d873f639a92d
SHA1 hash:
20c124debb05d60b79b50e39a0be5b9b93124658
SH256 hash:
91317464f677d1408e609d2296203b84cebed70ebc9aec92b51734c52db5bb32
MD5 hash:
68aa4f34a072419ae905d1cde1f95657
SHA1 hash:
eed899d2ae028a58bbb8bfb27c18282c26b2acee
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | pdb_YARAify |
|---|---|
| Author: | @wowabiy314 |
| Description: | PDB |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.