MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
SHA3-384 hash: 2b945e81853e3904d836d2b3f4fae9026c05d452fe20d7f28a00332174c8124f95070f1527ab1b269b477e52c12a2073
SHA1 hash: 47ce8f4b823855d35a3bd7a6af8a58850fa51304
MD5 hash: 424e40bad778d468e1a852ae7735b9e1
humanhash: florida-river-one-mango
File name:WinInstallerx64.exe
Download: download sample
File size:19'175'610 bytes
First seen:2024-07-21 00:20:47 UTC
Last seen:2024-07-21 01:22:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1f2702872592229d2f4cb1162cfbc55b (9 x STRRAT)
ssdeep 393216:200cHXJ2NacJY46ZElIlTFGw0CKM8FZPG6IOyS/Uv/PhHg:21cHX6mx8ITFGCkFOe0A
Threatray 13 similar samples on MalwareBazaar
TLSH T13E171223E0DA2031FD731A33A8A264633D3E59DCE48B286628F45BE3E972C495F57751
TrID 43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter ForensicITGuy
Tags:d3f@ck exe JPHP


Avatar
ForensicITGuy
Found on Github at hxxps[://]github[.]com/ravindrauppalapati/RoleManager/releases/download/Client/Win.Installer.x64.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
389
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://github.com/Mirza175/Mirza1751/releases/download/Test/Win.Installer.x64.zip
Verdict:
Malicious activity
Analysis date:
2024-03-24 16:47:16 UTC
Tags:
loader
Link:
https://app.any.run/tasks/97f08d45-97da-484e-b2f4-1e9369e95e3b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.28513.30040.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669c54712f6eaff4b90f0113
Tags:
Worgtop
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm lolbin mingw overlay packed shell32
Link:
https://www.filescan.io/uploads/669c5470cbb32227b6a9a189/reports/db07fa69-32fc-4eb1-818c-03bd9675381b/overview
Verdict:
Malicious
Labled as:
JAVA/Dldr.Agent
Link:
https://www.hybrid-analysis.com/sample/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
Result
Verdict:
MALICIOUS
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/281e8ad2-f8c0-4a7b-a1ce-13fb7a62e72f
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1414315
Behaviour
Behavior Graph:
n/a
Score:
33%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Malicious
First seen:
2024-03-11 00:14:20 UTC
File Type:
PE (Exe)
Extracted files:
6471
AV detection:
17 of 38 (44.74%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=stw7kolftgvkt7fjygtmuxlqnqjq74iql555dlh7qox7rlkrgfsa._file
Verdict:
unknown
Similar samples:
39cbdf74922f664235947e2063c96bed4d054238b838e97b23dfccf3a0234f0a
5a54cda9e42baea3defa9f1024858f7c44f79242b8765c9e886a8f54db6e1934
df0b2c36101cbf09511ebfe27d85bf3436dd2f3597356a40eb743825633d6ac6
e34e04a5ec0fe131236803262834901c0dc254b8583024050507e683a9b32932
f7c5c01dedc8af16e02e0559d7f973020588ec60c22abb5d25942cdc208f149d
f84667c031fff8048abdef17457270ccc3e31b1d8fa4b10f44a5d1c6791339d3
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240721-anb12atbpq/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/873a3830-b148-4301-9424-9e309a8a8bad
Unpacked files
SH256 hash:
94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
MD5 hash:
424e40bad778d468e1a852ae7735b9e1
SHA1 hash:
47ce8f4b823855d35a3bd7a6af8a58850fa51304
Link:
https://www.unpac.me/results/6802fb46-c2d4-4010-9dcc-09e4ff28514c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

(this sample)

  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CreateProcessA
kernel32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIkernel32.dll::GetStartupInfoA
kernel32.dll::GetCommandLineA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::FindWindowExA
user32.dll::CreateWindowExA

Comments