MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 12

Intelligence 12 IOCs YARA 2 File information Comments

SHA256 hash:	c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77
SHA3-384 hash:	7da885fabe44c73f57f0c7b51c5ec31acded702dcf1c70cb3a2dc8549d48eafe83448ec96cf31750c5e181cc832abd93
SHA1 hash:	4e10200d06e5ca34f987938194f7a6187d4382e4
MD5 hash:	e2d1fa109b827c4f12e8f445e92d8978
humanhash:	whiskey-washington-arkansas-juliet
File name:	CALC.EXE
Download:	download sample
File size:	94'208 bytes
First seen:	2025-03-19 08:12:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	98feaf0f8f73f7370e6122d9107f77bd
ssdeep	1536:FXKmyBTmOc8tYxGLUgOZmzq4EE76jXkF25kSuKkzyoVFrIHh:3y3c8tPxAXkFqyyCFrIHh
TLSH	T1BB93B61136D9F039E866053441D2AFFDA27E6E02157F62D6231A2C892E3F3867727787
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	0082b4b2cad2ab00 (2 x Kutaki, 1 x ShikataGaNai)
Reporter	Anonymous
Tags:	cih exe spacefiller Virus Win9x

Anonymous

Fresh sample of the CIH "spacefiller" virus. This sample is an infected calculator app taken from my friend's VM earlier.

Intelligence

File Origin

# of uploads :

# of downloads :

510

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

CALC.EXE

Verdict:

No threats detected

Analysis date:

2025-03-19 08:19:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/28b99dad-a8aa-4c45-b044-5f4bb19bb58a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.CIH-1

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67da8c61194f23322a711e49

Tags:

shellcode

Result

Verdict:

Malware

Maliciousness:

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67da7c9301edd28374b437e0/reports/553cc964-a5e5-4c91-893b-3e8d0296dfb6/overview

Verdict:

Malicious

Labled as:

Win95.CIH

Link:

https://www.hybrid-analysis.com/sample/c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Microsoft Corporation

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2c32bcb1-1ca3-4b30-be94-f45241c8f8bd

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/1642629

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

39%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77/

Threat name:

Win32.Virus.Cih

Status:

Malicious

First seen:

2025-03-19 08:13:09 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zfgvxg7byvn4qsxehwljq5xw5tfzcyatid6jyab7himomnuklr3q._file

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250319-j4ge5axr16/

Behaviour

System Location Discovery: System Language Discovery

Verdict:

Malicious

Tags:

Win.Trojan.CIH-1

YARA:

n/a

Link:

https://app.threat.zone/submission/d5eeede6-b70b-46a6-8854-5844ebf0231b

Unpacked files

SH256 hash:

c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77

MD5 hash:

e2d1fa109b827c4f12e8f445e92d8978

SHA1 hash:

4e10200d06e5ca34f987938194f7a6187d4382e4

Link:

https://www.unpac.me/results/b81a04a1-0bf9-4362-8c39-5a4f2c9b8eca/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	VxCIHVersion12TTITWIN95CIH Create hunting rule
Author:	malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

exe c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77

(this sample)

Link

https://www.virustotal.com/gui/file/c94d5b9be1c55bc84ae43d969876f6eccb91601340fc9c003f3a18e6368a5c77?nocache=1

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueExA
WIN_USER_API	Performs GUI Actions	USER32.dll::OpenClipboard USER32.dll::CreateWindowExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample