MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9d4f9aac1933e09f5ab82d1e247c77e624be93d086a81caf116af28555ddcc3c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 9d4f9aac1933e09f5ab82d1e247c77e624be93d086a81caf116af28555ddcc3c |
|---|---|
| SHA3-384 hash: | a5ab11df01c822e71b7382eb8f7cd06021809fea2e4a628682b24143ced37773ed285f6c3291353a1c031a4e37e1441d |
| SHA1 hash: | 6395582b82d5cf79373ee360eeeaccba7b57e6ef |
| MD5 hash: | 13d129d5ad4bf7234bcfdc21422e56c0 |
| humanhash: | pluto-blue-fillet-lactose |
| File name: | discord-install.exe |
| Download: | download sample |
| File size: | 3'281'184 bytes |
| First seen: | 2022-04-14 16:34:16 UTC |
| Last seen: | 2022-04-20 10:22:01 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 49152:Qqe3f6fsHwTPmDX0BLjXLLUyAt1ipmT+rV0CpCNcQqn224xH:lSifsKPWeLb/UyE1ipmyrV0HcliH |
| Threatray | 147 similar samples on MalwareBazaar |
| TLSH | T156E5E12FB2EC613ED45A0A3109B3A258597F7675AD1B8C1A17F0C90DCF664601E3BE1E |
| TrID | 61.8% (.EXE) Inno Setup installer (109740/4/30) 23.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 5.9% (.EXE) Win64 Executable (generic) (10523/12/4) 2.5% (.EXE) Win32 Executable (generic) (4505/5/1) 1.6% (.MZP) WinArchiver Mountable compressed Archive (3000/1) |
| File icon (PE): |  |
| dhash icon | f0e8e8d4d4ccccf0 |
| Reporter |  JaffaCakes118 |
| Tags: | exe signed |
Code Signing Certificate
| Organisation: | APELSIN LLC |
|---|---|
| Issuer: | Sectigo Public Code Signing CA R36 |
| Algorithm: | sha384WithRSAEncryption |
| Valid from: | 2022-02-09T00:00:00Z |
| Valid to: | 2023-02-09T23:59:59Z |
| Serial number: | 8639f7efa769f8accaf6c17912c7b9fc |
| Intelligence: | 2 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | b086854c909540073ecad80053ba640b8db09f071cb01f222b1749bcba64a08f |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
2
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
discord-install.exe
Verdict:
Malicious activity
Analysis date:
2022-04-14 16:29:38 UTC
Tags:
installer opendir
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
DNS request
Connecting to a non-recommended domain
Sending an HTTP GET request
Moving a file to the %temp% subdirectory
Sending a custom TCP request
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckNumberOfProcessor
CheckCmdLine
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
control.exe expand.exe overlay packed setupapi.dll shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
14 / 100
Signature
Obfuscated command line found
Behaviour
Behavior Graph:
n/a
Verdict:
suspicious
Similar samples:
+ 137 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
n/a
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
9d91940f37677b7b126b40ff839a1f9582206d0808dde1cc4102a83dda772a7c
MD5 hash:
bb50b736754a9f599095cf9126c6874c
SHA1 hash:
5bae73777c0408684d338623bc415ec4d46d334f
SH256 hash:
9d4f9aac1933e09f5ab82d1e247c77e624be93d086a81caf116af28555ddcc3c
MD5 hash:
13d129d5ad4bf7234bcfdc21422e56c0
SHA1 hash:
6395582b82d5cf79373ee360eeeaccba7b57e6ef
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 9d4f9aac1933e09f5ab82d1e247c77e624be93d086a81caf116af28555ddcc3c
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.