MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab
SHA3-384 hash:	8ede96fef778d289d63818f2194499ef7abf4a5add2aa673027f7f608aae886abd84ce42b0c85318b214236c0dbd1643
SHA1 hash:	0b21a4b04e79565e26e4236772d4605fc39862e7
MD5 hash:	a146dac7b641fff2c5c3c0cf320731aa
humanhash:	potato-bulldog-nitrogen-maryland
File name:	PITCHPOT.DAT
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	1'086'464 bytes
First seen:	2023-01-24 17:42:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	461b78f28d3ea5be2e2ffd3133d46dd3 (1 x IcedID)
ssdeep	24576:x7Vt9qfawrN27U1izzZaRbfp81L/Wm/nd6WrrUU9fQT:1BqfSU14Zadq1L/cWrrHfQ
TLSH	T1A0356C46E6A505ECC067907543BAB153F7A1301A0364ADF74B929B292F2BF907D37B23
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	pr0xylife
Tags:	1691396905 exe IcedID

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

267

Origin country :

BR

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

PITCHPOT.DAT

Verdict:

Malicious activity

Analysis date:

2023-01-24 17:45:31 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/86f29700-68f1-4074-8382-530220620412

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/356490/

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/63d018a7447edb203a00a66c/reports/08650fc1-82a6-4bc2-9aa8-05d83e0d8539/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Unknown

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/462e5c6b-3b3b-47b6-9650-0414265e80b7

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1158155

Signature

Sigma detected: Execute DLL with spoofed extension

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab/

ReversingLabs TitaniumCloud Win64.Trojan.IcedID

Threat name:

Win64.Trojan.IcedID

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-01-24 18:10:22 UTC

File Type:

PE+ (Dll)

AV detection:

17 of 25 (68.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=swwxjqo76uutysojkwsoo7ax42isy64nd7epl5gg6bnmo6swvgvq._file

Threatray icedid

Verdict:

malicious

Label(s):

icedid

Alert

Create hunting rule

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230124-waka5sch65/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

UnpacMe

Unpacked files

SH256 hash:

95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab

MD5 hash:

a146dac7b641fff2c5c3c0cf320731aa

SHA1 hash:

0b21a4b04e79565e26e4236772d4605fc39862e7

Link:

https://www.unpac.me/results/f30234b7-3130-4220-973a-4fafddbd448c/

VMRay IcedID

Malware family:

IcedID

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/95ad74c1dff5/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/95ad74c1dff5293c49c955a4e77c17e6912c7b8d1fc8f5f4c6f05ac77a56a9ab

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/356490/