MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 bff98589a003c088b8aecf04567743bbb9705bb1646177d0d8270f264b1df08e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | bff98589a003c088b8aecf04567743bbb9705bb1646177d0d8270f264b1df08e |
|---|---|
| SHA3-384 hash: | 68defdca852dea918ddb6a74f95a954d3223c307243c79bad9388ca605479e05c919c55f26390b7db09c1b34268f5c37 |
| SHA1 hash: | 13a169a369dcfe739ffe56e4a9d293a07b07c38c |
| MD5 hash: | 0466ac1588f557f98c9ce6c6cb5d387a |
| humanhash: | october-alpha-maine-zebra |
| File name: | SecuriteInfo.com.Win32.DH_TiRX.2778.8748 |
| Download: | download sample |
| File size: | 619'520 bytes |
| First seen: | 2020-03-20 09:31:58 UTC |
| Last seen: | 2020-03-30 07:05:18 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7d9a688d3d781cb443dd2dc08e6e88a9 |
| ssdeep | 6144:phk47jW94JVUakQMox1xGmhhu2V01caeSPfCvhJN+uRZlbhhmqAvNRihP+aK:pp7jgDzmhQiicaeSnCvfTm3riR+a |
| TLSH | AFD45A113364B23AC7EE4375A530853462B6AC26615ADB0E5DD4BDEB3C72F80A819F73 |
| Reporter |  SecuriteInfoCom |
Intelligence
File Origin
# of uploads :
3
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Grp
Status:
Malicious
First seen:
2018-08-10 17:21:24 UTC
AV detection:
14 of 31 (45.16%)
Threat level:
2/5
Verdict:
unknown
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe bff98589a003c088b8aecf04567743bbb9705bb1646177d0d8270f264b1df08e
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_TRUST_INFO | Requires Elevated Execution (level:requireAdministrator) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteW |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessW KERNEL32.dll::CloseHandle WININET.dll::InternetCloseHandle IPHLPAPI.DLL::IcmpCloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetCommandLineW |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateFileW IPHLPAPI.DLL::IcmpCreateFile KERNEL32.dll::FindFirstFileW KERNEL32.dll::GetTempFileNameW |
| WIN_REG_API | Can Manipulate Windows Registry | ADVAPI32.dll::RegOpenKeyExW ADVAPI32.dll::RegQueryValueExW |
| WIN_USER_API | Performs GUI Actions | USER32.dll::CreateWindowExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.