MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c673e00e0e5c771f2d146c07d656ba6c3ea2112146e5b382ba7391e513eb8160. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | c673e00e0e5c771f2d146c07d656ba6c3ea2112146e5b382ba7391e513eb8160 |
|---|---|
| SHA3-384 hash: | 85132a6942621bbef1ab78d5f1b674822e2db16c4446a2eb0f67617ccfe5c53ff718c3c3ebc7af364619795aa762fba6 |
| SHA1 hash: | 959e432c06de820e4778461befb789bde41ebba8 |
| MD5 hash: | a10aff228a835255b89419bebf24bdb2 |
| humanhash: | idaho-alpha-emma-one |
| File name: | SecuriteInfo.com.W32.PossibleThreat.5771.17792 |
| Download: | download sample |
| File size: | 1'375'744 bytes |
| First seen: | 2024-04-17 04:33:58 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fc6683d30d9f25244a50fd5357825e79 (92 x Formbook, 52 x AgentTesla, 23 x SnakeKeylogger) |
| ssdeep | 24576:14GHnhIzO6YYXsf9vA5eNizYpnjfONnXfoMBtyfuzRODhXym0Iwzl7DDEb81O:Cshd6YYXYNA5L+njat9ROEJNDEo1 |
| TLSH | T1FB55338CEA48032BD02B4A7C4C4119E57E7F7C25153655827342FBAEA5BC928C727B9F |
| TrID | 35.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 35.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.9% (.EXE) Win32 Executable (generic) (4504/4/1) |
| File icon (PE): |  |
| dhash icon | 6f4d1d0f4d47572b |
| Reporter |  SecuriteInfoCom |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
378
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c673e00e0e5c771f2d146c07d656ba6c3ea2112146e5b382ba7391e513eb8160.exe
Verdict:
Malicious activity
Analysis date:
2024-04-17 04:35:50 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Сreating synchronization primitives
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
lolbin packed packed packed shell32 upx
Verdict:
Malicious
Labled as:
Malware
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
56 / 100
Signature
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Score:
81%
Verdict:
Malware
File Type:
PE
Detection(s):
Suspicious file
Verdict:
unknown
Result
Malware family:
n/a
Score:
7/10
Tags:
aspackv2 upx
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
AutoIT Executable
ACProtect 1.3x - 1.4x DLL software
ASPack v2.12-2.42
Executes dropped EXE
Loads dropped DLL
UPX packed file
Unpacked files
SH256 hash:
1b23db051db8d0d109671a55066d5beb8ce77642d2bfac7864e00aa60abce487
MD5 hash:
57651a82c8edddfc114fdcdc56f54b61
SHA1 hash:
40073fc4c606b2f4cf355c8840ed5c311a155096
Detections:
AutoIT_Compiled
SH256 hash:
a5168301c2fb5eda7193efc70e8755b3559f4991a272237230818e424ada05fd
MD5 hash:
28fbde5ee1f0d23d91e94da4752989c8
SHA1 hash:
0bfb1ce6b29755762c40a973063c166ec1221536
SH256 hash:
6a7468490d9ae7b2ba9b398998a04405d5340fbcf59f713e005173acac57312d
MD5 hash:
02887de53e6348d202d74a0582e6f798
SHA1 hash:
0afc5dd5a95fbf67a9bcd360253ace6210e68d42
SH256 hash:
c673e00e0e5c771f2d146c07d656ba6c3ea2112146e5b382ba7391e513eb8160
MD5 hash:
a10aff228a835255b89419bebf24bdb2
SHA1 hash:
959e432c06de820e4778461befb789bde41ebba8
Detections:
SUSP_Imphash_Mar23_3
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | SUSP_Imphash_Mar23_3 |
|---|---|
| Author: | Arnim Rupp (https://github.com/ruppde) |
| Description: | Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits |
| Reference: | Internal Research |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_TRUST_INFO | Requires Elevated Execution (level:requireAdministrator) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| AUTH_API | Manipulates User Authorization | ADVAPI32.dll::GetAce |
| MULTIMEDIA_API | Can Play Multimedia | WINMM.dll::timeGetTime |
| WIN_BASE_API | Uses Win Base API | KERNEL32.DLL::LoadLibraryA |
| WIN_NETWORK_API | Supports Windows Networking | MPR.dll::WNetUseConnectionW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.