MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280
SHA3-384 hash: 5d5d043831bc92623714751886e1c3caee0bc64bb4e2c7fe240936f6f7dd3b353196adf4ce08f0f65ad814f618a7f86e
SHA1 hash: 152eca64515e0260bb417fa1ef9d74805018fbac
MD5 hash: 8eb3b1e4c31492708db3d0008d893dd5
humanhash: robert-timing-fifteen-sad
File name:flashplayerpp_install_cn.bin
Download: download sample
File size:2'285'312 bytes
First seen:2022-03-16 12:16:15 UTC
Last seen:2022-04-20 10:18:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5aa94c7fbfc01c9462c4d62e06efe88a
ssdeep 49152:TgGS1LSfK6NKyLKGJmfedZGEk6aftElvw29S1q2FG00INlby8vHRt2ws:clOS6syucmfoZvk64vW2FGelO8vxa
Threatray 40 similar samples on MalwareBazaar
TLSH T1F8B53358DB989969C19174F745679F5E8330E3202F2C8BEF1B067C18EA71EC3997C0A9
dhash icon c8c49aa9acd6ea86 (3 x CobaltStrike, 1 x Arechclient2, 1 x BadRabbit)
Reporter JAMESWT_WT
Tags:exe signed

Code Signing Certificate

Organisation:Adobe Inc.
Issuer:DigiCert EV Code Signing CA (SHA2)
Algorithm:sha256WithRSAEncryption
Valid from:2020-12-19T00:00:00Z
Valid to:2022-12-22T23:59:59Z
Serial number: 09c1cac4ac05dd06021020f8877ae7e8
Intelligence: 6 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b0178df3431a5942f44a96cc3709c4476434bd4bdc55399aa797dcf694ddf246
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
8
# of downloads :
219
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
flashplayerpp_install_cn.exe
Verdict:
Malicious activity
Analysis date:
2022-03-16 12:13:26 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b34bb520-31fd-48a6-bed3-ece834eb1dcc

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/251397/
Detection(s):
PUA.Win.Packer.PECompact-2
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% subdirectories
Searching for synchronization primitives
Creating a window
Creating a file
Searching for the window
Changing a file
DNS request
Sending a custom TCP request
Moving a recently created file
Sending an HTTP GET request
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/9448/overview
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6231d532b94fb38cb48e31a6/reports/a02e27db-e2dc-4d83-b084-40c09f98dd77/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/f62a16cd-d9ad-415c-88f8-a6b5fe6f1ec7
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
42 / 100
Link:
https://www.joesandbox.com/analysis/957924
Signature
Contains functionality to detect sleep reduction / modifications
Detected unpacking (changes PE section rights)
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280/
Threat name:
Win32.PUA.2144FlashPlayer
Create hunting rule
Status:
Malicious
First seen:
2021-06-08 08:12:46 UTC
File Type:
PE (Exe)
Extracted files:
396
AV detection:
4 of 27 (14.81%)
Threat level:
  1/5
Verdict:
unknown
Similar samples:
3175976cea0ac6b13312f1922423fca3f3d0bf99848f6b575c1063ed0f0cb8f4
77e4776f6db16b38b2bd6cd494017379be4cb291caab5300764c9d2857c49108
8f6483a13e91537054ed7f2a65d755dc447fbf092dbd2069058a7f42ed8065b2
a5a4d88e2fe16d319aef6f7550ca2379d253a943d467dedc21e7ea3deb19410e
a85fffc4f45740bc783406df43d854ddf74937094dbea3e9256fa9e9dcc8a7ea
a8f0dbc38f4fa81b8dc71d6a69df4a5a9963ad57de7c491a61044dbe42f586e5
bf4f50979b7b29f2b6d192630b8d7b76adb9cb65157a1c70924a47bf519c4edd
c3c8a11d78c3401c51a69fa84da23061174de66413adadb1b7b1b494ff55f74e
c3d80a43ca2e0d09cf23097aac6f1970d90a277ca4fdd0aedf5ecc8526ecdba4
+ 30 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220316-pf2daadef2/
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
467f6766c0fe82abc9286b530d7fa455360c8c7f20a7f28461c54873e4e4de21
MD5 hash:
6be622c4fd3a217b3f45dcd0b1897ffe
SHA1 hash:
0d31265517b835028a81eaf4e16dd3b60d4bc874
Link:
https://www.unpac.me/results/171d4cc6-491b-4892-abc9-a2b893f05f8a/
Parent samples :
e8d6393b63beba6b6cad43f7068f597f9a9c89effba80917412c3f438214ec5c
1eb83f805c41a946b3cf639512ddfe1da13fce7aca90270448f1b03c343befff
c513dde23b6e4d4274696e7598f01f0bc96953ad14556fb7de24c765ab574327
f52ed6bc805585d9e81b15a327af3ecbccc67aac180dff55968b5133035ce74d
b09326eda96f66176f54837d11d485a281dd89f24addc68f2c1e5cfedffe90e3
490c76da1ec8a15a782850b4468cc7ab780ce8cc436d7b490c280588864940cf
363e545ebbeb5eafa15f17986c7e90abebe28774b7b4bb2c1fcb2ff64c9158b8
021cdda10106e4db66873cd411ae3ea1d63ce01a0de1889f658d73c84ea00c8e
68ad2b97e4e2c2e2dedd7b7cbb3a0483c09948513f849bcd22ebeee1f8f40cd3
797c029eb74037b438d4c8eebc774dd45c243e86570d0a2118b168ea7472ca0d
a3ee42d49a63d91f51e144c2372002385da3573c8179ed743eef439904a6cdf4
55d421ed6221bf7cb9cfc4a78c3b7dd8407f19933fd26af3adb4f659bfe81abb
3803477a8eaad24fbd1fb71245a009f371eab35186065534bb14ae5dc41f8e4b
e88a142edb195e0d7e73616f3f5edc8a8ae6fd811c2985ac591c0925122ca8ee
66a517357eb8d9d77f8e4f1e67bcb3d3ad36b95010ae2a47caef8fe9018bcfe6
0916b368912885a4b72e1f309de846041bcbb3b74e478964f11797f0e4ace419
4c5b6f817e37e530c3440d02fcfd808aaef1e15f880fc9cdb43799ecc86bb1e9
d0d9d1a383cd3123e3a740793e4e9dab17701dd26856c3d13bdd84aa9b6f3c44
0504da7e2670ac33821b1d29ab8e430bd262a873fd07dfae680e7816c705cdd2
5783db0ba968957f967255d34b62546fdd3f6e70aa65b2b3fae44228bf6441ca
SH256 hash:
94bf4afd3a77d76311159daa2f19643a7f7d1e2c4b37807651b328feeef34668
MD5 hash:
1115be7832a7fa6005cb06aa20cdbb5c
SHA1 hash:
d0cf4dcc15749f031b4f5631bd603daf3bae1696
Link:
https://www.unpac.me/results/171d4cc6-491b-4892-abc9-a2b893f05f8a/
SH256 hash:
ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280
MD5 hash:
8eb3b1e4c31492708db3d0008d893dd5
SHA1 hash:
152eca64515e0260bb417fa1ef9d74805018fbac
Link:
https://www.unpac.me/results/171d4cc6-491b-4892-abc9-a2b893f05f8a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/251397/

Comments