MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
SHA3-384 hash:	2b945e81853e3904d836d2b3f4fae9026c05d452fe20d7f28a00332174c8124f95070f1527ab1b269b477e52c12a2073
SHA1 hash:	47ce8f4b823855d35a3bd7a6af8a58850fa51304
MD5 hash:	424e40bad778d468e1a852ae7735b9e1
humanhash:	florida-river-one-mango
File name:	WinInstallerx64.exe
Download:	download sample
File size:	19'175'610 bytes
First seen:	2024-07-21 00:20:47 UTC
Last seen:	2024-07-21 01:22:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1f2702872592229d2f4cb1162cfbc55b (9 x STRRAT)
ssdeep	393216:200cHXJ2NacJY46ZElIlTFGw0CKM8FZPG6IOyS/Uv/PhHg:21cHX6mx8ITFGCkFOe0A
Threatray	13 similar samples on MalwareBazaar
TLSH	T13E171223E0DA2031FD731A33A8A264633D3E59DCE48B286628F45BE3E972C495F57751
TrID	43.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 22.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 9.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Reporter	ForensicITGuy
Tags:	d3f@ck exe JPHP

ForensicITGuy

Found on Github at hxxps[://]github[.]com/ravindrauppalapati/RoleManager/releases/download/Client/Win.Installer.x64.zip

Intelligence

File Origin

# of uploads :

# of downloads :

394

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

https://github.com/Mirza175/Mirza1751/releases/download/Test/Win.Installer.x64.zip

Verdict:

Malicious activity

Analysis date:

2024-03-24 16:47:16 UTC

Tags:

loader

Link:

https://app.any.run/tasks/97f08d45-97da-484e-b2f4-1e9369e95e3b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.FileRepMalware.28513.30040.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=669c54712f6eaff4b90f0113

Tags:

Worgtop

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm lolbin mingw overlay packed shell32

Link:

https://www.filescan.io/uploads/669c5470cbb32227b6a9a189/reports/db07fa69-32fc-4eb1-818c-03bd9675381b/overview

Verdict:

Malicious

Labled as:

JAVA/Dldr.Agent

Link:

https://www.hybrid-analysis.com/sample/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/281e8ad2-f8c0-4a7b-a1ce-13fb7a62e72f

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1414315

Behaviour

Behavior Graph:

n/a

Score:

33%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2024-03-11 00:14:20 UTC

File Type:

PE (Exe)

Extracted files:

6471

AV detection:

17 of 38 (44.74%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=stw7kolftgvkt7fjygtmuxlqnqjq74iql555dlh7qox7rlkrgfsa._file

Verdict:

unknown

5a54cda9e42baea3defa9f1024858f7c44f79242b8765c9e886a8f54db6e1934

df0b2c36101cbf09511ebfe27d85bf3436dd2f3597356a40eb743825633d6ac6

e34e04a5ec0fe131236803262834901c0dc254b8583024050507e683a9b32932

f7c5c01dedc8af16e02e0559d7f973020588ec60c22abb5d25942cdc208f149d

f84667c031fff8048abdef17457270ccc3e31b1d8fa4b10f44a5d1c6791339d3

+ 3 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/240721-anb12atbpq/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/873a3830-b148-4301-9424-9e309a8a8bad

Unpacked files

SH256 hash:

94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

MD5 hash:

424e40bad778d468e1a852ae7735b9e1

SHA1 hash:

47ce8f4b823855d35a3bd7a6af8a58850fa51304

Link:

https://www.unpac.me/results/6802fb46-c2d4-4010-9dcc-09e4ff28514c/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164

(this sample)

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
SHELL_API	Manipulates System Shell	shell32.dll::ShellExecuteA
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessA kernel32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	kernel32.dll::GetStartupInfoA kernel32.dll::GetCommandLineA
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExA advapi32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	user32.dll::FindWindowExA user32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample