MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bf29918a0b7d197baf8bfe6c2338ca4f5428280ba5375cb48fd02b92acc55f38. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | bf29918a0b7d197baf8bfe6c2338ca4f5428280ba5375cb48fd02b92acc55f38 |
|---|---|
| SHA3-384 hash: | b322b50a2009ae00b12ecae7f0537ccebb6392e37eaf9f8e3d0fabbc2d6fb9072cf668191cdfdb9ea58d545b0a1d7528 |
| SHA1 hash: | 6d045fd02543466150cd6a1fd34b655c428b3efe |
| MD5 hash: | dc7ba7c95902aefcade2e524e1a4ce8b |
| humanhash: | network-cola-charlie-uranus |
| File name: | SPEPAY13012021-20-00000009.pdf.exe |
| Download: | download sample |
| File size: | 768'675 bytes |
| First seen: | 2021-01-14 20:19:11 UTC |
| Last seen: | 2021-01-14 21:35:15 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet) |
| ssdeep | 12288:5hxp3lZnT9bDNkdAAcF3G3FFufkqzpabfsfqKLKiqGp4Imq8Dra0N58nP5Y:5Jlh9bDN+ApFW3usMabfsiKLHqr5q8Df |
| Threatray | 335 similar samples on MalwareBazaar |
| TLSH | E6F4BEE1B780C471D8B35539983A9B636837B51D8D68890D2BD1BF1F7D723824027EAB |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: vxsys-smtpclusterma-05.srv.cat
Sending IP: 46.16.61.63
From: supporto_clienti.it@epayworldwide.com
Reply-To: supporto_clienti.it@epayworldwide.com
Subject: Invoice Epay
Attachment: SPEPAY13012021-20-00000009.pdf.rar (contains "SPEPAY13012021-20-00000009.pdf.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SPEPAY13012021-20-00000009.pdf.exe
Verdict:
No threats detected
Analysis date:
2021-01-14 20:27:49 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Creating a file in the Program Files subdirectories
Launching a process
Creating a process from a recently created file
Creating a file
Creating a service
Launching a service
DNS request
Sending a custom TCP request
Sending a UDP request
Enabling autorun for a service
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
92 / 100
Signature
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to detect sleep reduction / modifications
Contains functionality to infect the boot sector
Contains functionalty to change the wallpaper
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.AnyplaceControl
Status:
Malicious
First seen:
2021-01-14 20:20:10 UTC
AV detection:
21 of 46 (45.65%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 325 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
8/10
Tags:
bootkit persistence
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Drops file in Program Files directory
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Loads dropped DLL
Executes dropped EXE
Unpacked files
SH256 hash:
ebcfa21ef429d234f46441c194abe77e32efeed05161e18cecae7dc04f1a7cc7
MD5 hash:
cd6f5c8643d7ebbe363ad1da70c3372a
SHA1 hash:
13df3c7c28ce730605892d7a974cd788dc7ac449
SH256 hash:
bf29918a0b7d197baf8bfe6c2338ca4f5428280ba5375cb48fd02b92acc55f38
MD5 hash:
dc7ba7c95902aefcade2e524e1a4ce8b
SHA1 hash:
6d045fd02543466150cd6a1fd34b655c428b3efe
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe bf29918a0b7d197baf8bfe6c2338ca4f5428280ba5375cb48fd02b92acc55f38
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.