MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628
SHA3-384 hash: 03d3bc6453dcb3ec033b82655f9535de6fc70a2e45d2b41dabb55631bf01496e5453de64625deb4c4151269efd7202a5
SHA1 hash: 82a82e2e70dafb8506758a9df611da8b6446468b
MD5 hash: 9a763983062d63c74ca33a0c5a8d5d91
humanhash: network-sixteen-oklahoma-fruit
File name:9a763983062d63c74ca33a0c5a8d5d91.exe
Download: download sample
File size:3'743'136 bytes
First seen:2023-08-28 09:34:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 98304:gYOpjnaDe7pEGzyiQDOuknu4TNPu5zGxQ:gbJEeOGZPuknu4TNAzGxQ
TLSH T12306333761061097D0E1D8B74A23FD81F3B656BA8BC3AC78B7D968C634354F8E292D52
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4505/5/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/444882/
Result
Verdict:
Clean
Maliciousness:
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin overlay packed packed shell32
Link:
https://www.filescan.io/uploads/64ec6a499ff753467d7fc59d/reports/b9a555c2-5428-43e5-9e06-a7faa26fe832/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/91e5e07f-b2f8-42a4-9b8b-faef25f10474
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
56 / 100
Link:
https://www.joesandbox.com/analysis/1298593
Signature
Detected VMProtect packer
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xdoxhao2xoyn6m3x37sygqpuqf4wlbscrmkmmiqd4lvnnx7nsyua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
vmprotect
Link:
https://tria.ge/reports/230828-lkcc6scf3s/
Unpacked files
SH256 hash:
b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628
MD5 hash:
9a763983062d63c74ca33a0c5a8d5d91
SHA1 hash:
82a82e2e70dafb8506758a9df611da8b6446468b
Link:
https://www.unpac.me/results/01a90e7d-5d9e-4b57-b667-f5a5357672e2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe b8dd7381dabbb0df3377dfe58341f481796586428b14c62203e2ead6dfed9628

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/444882/
  
URLhaus
https://urlhaus.abuse.ch/url/2693295/
  
Delivery method
Distributed via web download

Comments