MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 17 File information Comments

SHA256 hash:	ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214
SHA3-384 hash:	c65d6edfd73dd6c4a1ba21ed8a5543ec284ee39def3b59800142e2566a4b3e834ae20af4d822e257d0abd0acdb09271d
SHA1 hash:	4c45e389c42e633be43da02f2e9942a08f2d566a
MD5 hash:	12c18dff6d0f5685eb9041a64c3a09b6
humanhash:	freddie-magnesium-hot-papa
File name:	ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214
Download:	download sample
File size:	6'281'256 bytes
First seen:	2025-04-22 12:38:44 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8f53fe7a308ce6a5a85121170e0ee4e0
ssdeep	49152:DySPB35XuxTtre6+1po3ZXQLpFtqSS3rVZAYD84IO9c9vMa13FG8HlNl4Iz93q/P:D0apLoDV29pvJ2A2G8ys6D/5i
TLSH	T1E656BE14A3E800B1E57BDB34CA62C333DA70BC925635D10F0998E6461F77EA29B6F725
TrID	66.6% (.EXE) InstallShield setup (43053/19/16) 16.2% (.EXE) Win64 Executable (generic) (10522/11/4) 7.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 3.1% (.EXE) OS/2 Executable (generic) (2029/13) 3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe MonniSoftwareOy signed

Code Signing Certificate

Organisation:	Monni Software Oy
Issuer:	SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-02-07T17:37:35Z
Valid to:	2026-02-07T17:37:35Z
Serial number:	46e097ebe44bf0363e5830369d708b81
Intelligence:	4 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Central Blocklist:	This certificate is on the Cert Central blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	88de188144f0fc056a79889463306c22f1fce4e97c234cf2b76c260ce8b17d6e
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

491

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214

Verdict:

No threats detected

Analysis date:

2025-04-22 13:03:14 UTC

Tags:

auto-download

Link:

https://app.any.run/tasks/01372483-20cd-4ae1-b66c-ce8667c77d0c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3417/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68078f11892d799f537abed5

Tags:

injection obfusc remo

Result

Verdict:

Clean

Maliciousness:

Verdict:

Suspicious

Labled as:

Malware_49.8

Link:

https://www.hybrid-analysis.com/sample/ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/bce1f66d-b685-49e1-806f-427cce470b33

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

24 / 100

Link:

https://www.joesandbox.com/analysis/1671036

Signature

Found Tor onion address

Behaviour

Behavior Graph:

Download SVG

Score:

53%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vujzcv4glf7zoaoq3aiieymv55kvltulxjkap4ufzimthhbemika._file

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/250422-pvrsdsyrv9/

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/680c2ed1-ca9e-4642-b460-558f04461cc8

Unpacked files

SH256 hash:

ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214

MD5 hash:

12c18dff6d0f5685eb9041a64c3a09b6

SHA1 hash:

4c45e389c42e633be43da02f2e9942a08f2d566a

Link:

https://www.unpac.me/results/1dbd10ea-92fe-439b-a30d-4d6dfe6dbf76/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ad13915786597f9701d0d810826195ef5555ce8bba5407f285ca19339c246214

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_Debugger Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__RemoteAPI Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Jupyter_infostealer Create hunting rule
Author:	CD_R0M_
Description:	Rule for Jupyter Infostealer/Solarmarker malware from september 2021-December 2022

Rule name:	Lumma_Stealer_Detection Create hunting rule
Author:	ashizZz
Description:	Detects a specific Lumma Stealer malware sample using unique strings and behaviors
Reference:	https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/3417/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (GUARD_CF)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::RevertToSelf
NCRYPT_API	Uses NCrypt API	ncrypt.dll::NCryptImportKey ncrypt.dll::NCryptOpenKey
SECURITY_BASE_API	Uses Security Base API	ADVAPI32.dll::AdjustTokenPrivileges ADVAPI32.dll::GetTokenInformation ADVAPI32.dll::ImpersonateLoggedOnUser
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CreateProcessW ADVAPI32.dll::OpenProcessToken KERNEL32.dll::OpenProcess ADVAPI32.dll::OpenThreadToken KERNEL32.dll::VirtualAllocExNuma KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleOutputCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::DeleteFileW KERNEL32.dll::GetSystemDirectoryW
WIN_BASE_USER_API	Retrieves Account Information	ADVAPI32.dll::LookupPrivilegeValueW
WIN_BCRYPT_API	Can Encrypt Files	bcrypt.dll::BCryptCreateHash bcrypt.dll::BCryptDecrypt bcrypt.dll::BCryptDestroyHash bcrypt.dll::BCryptDestroyKey bcrypt.dll::BCryptEncrypt bcrypt.dll::BCryptExportKey
WIN_CRYPT_API	Uses Windows Crypt API	CRYPT32.dll::CertAddCertificateContextToStore CRYPT32.dll::CertAddCertificateLinkToStore CRYPT32.dll::CertCreateCertificateChainEngine CRYPT32.dll::CertDuplicateCertificateContext CRYPT32.dll::CertEnumCertificatesInStore CRYPT32.dll::CertFindCertificateInStore
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW
WIN_SOCK_API	Uses Network to send and receive data	WS2_32.dll::FreeAddrInfoExW WS2_32.dll::FreeAddrInfoW WS2_32.dll::GetAddrInfoW WS2_32.dll::GetAddrInfoExW WS2_32.dll::GetNameInfoW WS2_32.dll::WSAConnect

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample