MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9131f78f68a82c062393fb196cbedf6965f3179f8cead139c27c4325a4418ad2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 9131f78f68a82c062393fb196cbedf6965f3179f8cead139c27c4325a4418ad2 |
|---|---|
| SHA3-384 hash: | d8502dede812f745ceaadb5db3caeed824fb6b8ad30f10a8c6250b4d0ced2a5ab23445a9363496bcb968d19e0c36877e |
| SHA1 hash: | 3a2f566c3f743593c423d2c0fd06f44d3c21c10c |
| MD5 hash: | 7d8d85f8942697430ae4144f84ab16c6 |
| humanhash: | delta-early-mockingbird-ink |
| File name: | PRODUCT SPECIFICATION.exe |
| Download: | download sample |
| File size: | 1'877'504 bytes |
| First seen: | 2020-12-31 07:50:19 UTC |
| Last seen: | 2020-12-31 09:41:26 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 24576:GmTGSdRCcxDDkbvtPF3laWGgZpMByQjQCt8Vgg5tvo1JJVK2/DFl1hQp2L6Vb:QSdrJDkbNF32ONCiyg5tgVKIlc2L |
| Threatray | 44 similar samples on MalwareBazaar |
| TLSH | 6B95235023A45719E17EFB794CB2425617F6FC18E321D23EBEE260985486FB04532FBA |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: santamarina.com.br
Sending IP: 62.113.215.224
From: PURCHASE1<info@santamarina.com.br>
Subject: PRODUCT SPECIFICATION
Attachment: PRODUCT SPECIFICATION.Z (contains "PRODUCT SPECIFICATION.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
194
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PRODUCT SPECIFICATION.exe
Verdict:
Malicious activity
Analysis date:
2020-12-31 16:28:53 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Signature
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
suspicious
Similar samples:
+ 34 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
9/10
Tags:
evasion
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Drops file in Program Files directory
Drops file in Windows directory
Drops autorun.inf file
Suspicious use of SetThreadContext
JavaScript code in executable
Maps connected drives based on registry
Checks BIOS information in registry
Drops startup file
Loads dropped DLL
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Unpacked files
SH256 hash:
e83214acb6ecb6596d8d35e24fcb63c106f4913d18d6037e63efb19ead502705
MD5 hash:
d99e8998938139bc7d3da11d23851725
SHA1 hash:
abb6430c26058cf2683ab2209247d2c8efd976c8
SH256 hash:
16dbdae16ffa72c0608508d97ae6a936319efdcf156cef104fd668de9687da9c
MD5 hash:
fde0a46dcbc4ef444a0296a5a0c94f80
SHA1 hash:
90e25968d12c1a66392265563ad64ff1a8450c31
SH256 hash:
c9ce3ccdc5bcd1b99425256c51c32490e9e7cee41e2e76bd8e95dd21cf625fc1
MD5 hash:
77a84e7e8b53166e7396691d1ee5ddaf
SHA1 hash:
9ff23048acd6b877da70883cd7f084e081fa95a9
SH256 hash:
d77ec70def532bfbfafcad1bddce9173df2ed7dc8adb15004f8b6ed8f45999be
MD5 hash:
6cc44e992454153cbb1afec4acf04457
SHA1 hash:
683fba1da8b79b1de75b66af04d8dcfd66aa673a
SH256 hash:
44106a7753790a12c522849b3f7da238337bd0342e5664021e25f79b2705ae9a
MD5 hash:
d43e8dcc8f8b23c144f820eaa9bdbee4
SHA1 hash:
41faa61eb543ac1386e59ef1e3c485a19458ff68
SH256 hash:
f0fd73b2a57acb5818403bddf91816ed6271a8c3e7d9108da24925d88ae75551
MD5 hash:
d12364edba1a1ebf013c049efcd9f2c3
SHA1 hash:
0284d6b57788fd9ef7964a0d526c91174d2d38b8
SH256 hash:
9131f78f68a82c062393fb196cbedf6965f3179f8cead139c27c4325a4418ad2
MD5 hash:
7d8d85f8942697430ae4144f84ab16c6
SHA1 hash:
3a2f566c3f743593c423d2c0fd06f44d3c21c10c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 9131f78f68a82c062393fb196cbedf6965f3179f8cead139c27c4325a4418ad2
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.