🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715
SHA3-384 hash: 58114af74b0cc7b97fe7378bf361b6ec977333c56d1ea23a86ddb48de2f86c6326fcbd1e36ba4c4352def9f162a4a9d1
SHA1 hash: e53c665ed01e497874627ac654d6f90832dba1af
MD5 hash: 005245fcbca50a836235392c802198a8
humanhash: high-yankee-blue-winner
File name:Player reports algnet 07-10-2024 .pdf www.skype.com
Download: download sample
File size:4'284'934 bytes
First seen:2024-10-07 22:21:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2b038313242eff88172dd3dbdaa72202
ssdeep 98304:gqwsVKHOycs8IZPGQe92Mxvtq44djR/1eZhRj:gHrelDVq4OjR/+Rj
TLSH T15816AF13B285A53EC07B1E396937D710993BBA213A53DC4B57F40A8CDF359902E3A687
TrID 46.7% (.EXE) Inno Setup installer (107240/4/30)
25.0% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
18.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
4.5% (.EXE) Win64 Executable (generic) (10523/12/4)
1.9% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
File icon (PE):PE icon
dhash icon f8f89c969392ece4 (3 x RedLineStealer, 2 x Formbook, 1 x Amadey)
Reporter PeterGabaldon
Tags:exe gibbooc2.com remcos


Avatar
PedroGabaldon
Distributed via Skype chat

Intelligence

File Origin
# of uploads :
1
# of downloads :
458
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Player reports algnet 07-10-2024 .pdf www.skype.com
Verdict:
Malicious activity
Analysis date:
2024-10-07 22:27:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f93ffb1f-1a55-4839-b7b4-7c0e03332e99

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.IMG.EXE-in-JPG-1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67045f0ca69182ddbe5cce09
Tags:
Powershell Delphi
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bc47f94b-fe2b-4614-8cb9-66f006dfd0e4
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1528513
Signature
Creates an autostart registry key pointing to binary in C:\Windows
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528513 Sample: Player reports algnet 07-10... Startdate: 08/10/2024 Architecture: WINDOWS Score: 60 36 gibbooc2.com 2->36 40 Initial sample is a PE file and has a suspicious name 2->40 8 Player reports algnet 07-10-2024 .pdf       www.skype.com.exe 12 2->8         started        11 reg.exe 1 1 2->11         started        14 regsvr32.exe 2->14         started        16 regsvr32.exe 2->16         started        signatures3 process4 file5 32 C:\Users\user\AppData\...\HitPawInfo.exe, PE32+ 8->32 dropped 34 C:\Users\user\AppData\Local\Temp\PCInfo.dll, PE32+ 8->34 dropped 18 HitPawInfo.exe 3 8->18         started        46 Creates an autostart registry key pointing to binary in C:\Windows 11->46 22 conhost.exe 11->22         started        signatures6 process7 file8 30 C:\Users\user\AppData\...\ResPrompt.dll, PE32+ 18->30 dropped 42 Found direct / indirect Syscall (likely to bypass EDR) 18->42 24 regsvr32.exe 18->24         started        28 WerFault.exe 19 16 18->28         started        signatures9 process10 dnsIp11 38 gibbooc2.com 154.21.14.89, 22455, 49753, 49788 COGENT-174US United States 24->38 44 System process connects to network (likely due to code injection or exploit) 24->44 signatures12
Score:
91%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyoted3xhkdarf56oporn6afsaxp7lvnge4hhmggek6g5745w4kq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/241007-1986rswcqp/
Behaviour
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/39b114a2-3d0a-42e4-9c07-c7d5a5bcf8b8
Unpacked files
SH256 hash:
b81a96a53ab20f43624ce4e8d25468ab8f65ef88441368cda0c9c54525db31f6
MD5 hash:
438909882796242739c542d4aa5e94da
SHA1 hash:
e2a82d09c76c6a59f909cb35d4bf4f4f862213e1
Link:
https://www.unpac.me/results/9508a198-64ef-4408-a888-fb40e7acd3cb/
SH256 hash:
5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85
MD5 hash:
00ced89a573ad1e1f96c94c763222e1e
SHA1 hash:
808183d9160a89ad3c8730d2b6b76803ca97f38f
Link:
https://www.unpac.me/results/9508a198-64ef-4408-a888-fb40e7acd3cb/
SH256 hash:
be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715
MD5 hash:
005245fcbca50a836235392c802198a8
SHA1 hash:
e53c665ed01e497874627ac654d6f90832dba1af
Link:
https://www.unpac.me/results/9508a198-64ef-4408-a888-fb40e7acd3cb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe be1d320f773a860897be73dd16f805902effaead313873b0c622bc6eff9db715

(this sample)

Executable exe 5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85

  
Delivery method
Other
  
Dropping
SHA256 5fc1bd27c679b1b5306996cfa518fa1a7b4fb60e0fe6ea92bb4ba3b82c471a85
  
Dropping
MD5 00ced89a573ad1e1f96c94c763222e1e
  
Dropping
SHA256 15c4c03c0e4345a3fcc08e55164ed5cf004d8c2c40a46d7f7db891f312226497
  
Dropping
MD5 e1bdfa7bc2ec8370102e69de1fdc2800

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User Authorizationadvapi32.dll::AllocateAndInitializeSid
advapi32.dll::EqualSid
advapi32.dll::FreeSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
SECURITY_BASE_APIUses Security Base APIadvapi32.dll::AdjustTokenPrivileges
advapi32.dll::GetTokenInformation
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExW
shell32.dll::ShellExecuteW
shell32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and Threadsadvapi32.dll::OpenProcessToken
kernel32.dll::OpenProcess
advapi32.dll::OpenThreadToken
wininet.dll::InternetCloseHandle
kernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::TerminateProcess
kernel32.dll::LoadLibraryA
kernel32.dll::LoadLibraryExW
kernel32.dll::LoadLibraryW
kernel32.dll::GetDriveTypeW
kernel32.dll::GetVolumeInformationW
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::GetConsoleOutputCP
kernel32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create Fileskernel32.dll::CopyFileW
kernel32.dll::CreateDirectoryW
kernel32.dll::CreateFileW
kernel32.dll::CreateFileMappingW
kernel32.dll::DeleteFileW
kernel32.dll::GetFileAttributesW
WIN_BASE_USER_APIRetrieves Account Informationadvapi32.dll::LookupPrivilegeValueW
kernel32.dll::QueryDosDeviceW
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegConnectRegistryW
advapi32.dll::RegCreateKeyExW
advapi32.dll::RegDeleteKeyW
advapi32.dll::RegLoadKeyW
advapi32.dll::RegOpenKeyExW
advapi32.dll::RegQueryInfoKeyW
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowExW
user32.dll::FindWindowW
user32.dll::OpenClipboard

Comments