MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281
SHA3-384 hash:	3ba7898bf592be56e8b3d213889b1dc7857a194cdd73937e11b912fb517b8832859265c467606939f08b9a80ab81833c
SHA1 hash:	cbbe65d3c3f1cb7314beea5764dfca0a0df0d381
MD5 hash:	4200f1f95388e72430d84ded29747557
humanhash:	snake-orange-minnesota-twelve
File name:	4200f1f95388e72430d84ded29747557.exe
Download:	download sample
File size:	1'324'032 bytes
First seen:	2025-03-04 09:18:54 UTC
Last seen:	2025-03-04 09:48:23 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	db0481ffa68897d90df5d9ef87692a4f
ssdeep	24576:SNsqh2gxNOw1vbwP5pt9yDer4kFhBVyE90E8U/j5Cqe1MDxwiS+XvvfkVMn2gQ:SN/2gLOw25r42huE90E8U/j5Cqe1MDx6
TLSH	T11355231DFBA69363C10E5134C8AE862291927D352D9609C79C973FFE7338343AEE5186
TrID	34.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 34.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.7% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	e0d99c8c99e46686 (4 x DCRat, 2 x FFDroider, 2 x LummaStealer)
Reporter	abuse_ch
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

422

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

4200f1f95388e72430d84ded29747557.exe

Verdict:

No threats detected

Analysis date:

2025-03-04 09:28:13 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/30c7b2a7-be37-4818-bf26-c7418cc72fb6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.Malware-gen.21957.28987.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c6c655c668b65489bee8ea

Tags:

virus

Result

Verdict:

Clean

Maliciousness:

Verdict:

Malicious

Labled as:

Jaik.Generic

Link:

https://www.hybrid-analysis.com/sample/94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Microsoft Corporation

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/b0cb5ddb-4ddd-41e5-9c4a-c8205ad6d756

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1628982

Signature

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sstxjideskgvo2blvy3x236rxswbduuod7pdrey3sbsbeevoekaq._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery upx

Link:

https://tria.ge/reports/250304-k99jjaxms5/

Behaviour

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

UPX packed file

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/69214d42-bab7-47f3-8ec4-9729d255be7c

Unpacked files

SH256 hash:

94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281

MD5 hash:

4200f1f95388e72430d84ded29747557

SHA1 hash:

cbbe65d3c3f1cb7314beea5764dfca0a0df0d381

Link:

https://www.unpac.me/results/937ea965-bddd-46ca-9662-d781643017d2/

SH256 hash:

d38f9ac428215da65edf56c2603b45f36c16793c8a9dc1fde60b1a3a92ba4c4f

MD5 hash:

067a4dbb1381035fb219b55ddde768b2

SHA1 hash:

fe527b2cbd2a236ca824141ab9f455025de649be

Link:

https://www.unpac.me/results/937ea965-bddd-46ca-9662-d781643017d2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser Create hunting rule
Author:	malware-lu

Rule name:	UPXv20MarkusLaszloReiser Create hunting rule
Author:	malware-lu

Rule name:	upx_3 Create hunting rule
Author:	Kevin Falcoz
Description:	UPX 3.X

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 94a774a064928d57682bae377d6fd1bcac11d28e1fde38931b90641212ae2281

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3423143/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.DLL::LoadLibraryA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample