MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 13
| SHA256 hash: | c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8 |
|---|---|
| SHA3-384 hash: | a45eea51a4ca1b6ea645524726e939e4bb5931332a0ae8f42699261630fc977d61e546d3402a88757c1119d80d46fc55 |
| SHA1 hash: | 5bd1f44267d82e2255b7c035d05d38e44c7b3261 |
| MD5 hash: | 05d1c2995d41bfae991c4593ebcaeb53 |
| humanhash: | king-florida-orange-two |
| File name: | InikaaurHB38BXW.exe |
| Download: | download sample |
| File size: | 666'112 bytes |
| First seen: | 2024-04-15 13:08:08 UTC |
| Last seen: | 2024-04-15 19:51:56 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'454 x Formbook, 12'202 x SnakeKeylogger) |
| ssdeep | 12288:AaAv3zT370X1fouNe8Gqr1j2tGosPCo0bf9yUnkdI+6GXaPApTiy8kFQc:79Gsh0s6vlnnkdIrGK/e |
| TLSH | T18EE4122677AE8B56C3BA87F2603212409BB14C0F4A36C7AC8DC9F0C5AA63F14465DF43 |
| TrID | 63.0% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.2% (.SCR) Windows screen saver (13097/50/3) 9.0% (.EXE) Win64 Executable (generic) (10523/12/4) 5.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| File icon (PE): |  |
| dhash icon | e9e098ae9aba8ab2 (12 x AgentTesla, 2 x Formbook, 1 x DarkCloud) |
| Reporter |  lowmal3 |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
2
# of downloads :
301
Origin country :
DEVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8.exe
Verdict:
Suspicious activity
Analysis date:
2024-04-15 13:15:02 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
packed
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
68 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Behaviour
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
PE
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2024-04-15 12:19:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
16 of 23 (69.57%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
5688052489392c2ca7179722bfb5ad4883db768cbad0d344c329dff69ddde94e
MD5 hash:
990f3e5448706e10108c3108971d07a5
SHA1 hash:
cf0011a08216722addbb5634c09be07e3691b872
SH256 hash:
da02d4772bf049d17706e73da54b66aa8bedf9dd8bd91f24cf2e44396f49fcc5
MD5 hash:
3b5a5cdb767557d63b153359c8d57ab3
SHA1 hash:
97338f83d708a0f2b65db9c7567e4bece2ba311f
SH256 hash:
6c4a2931506f6d2be6083c1b018222a4efeecc2c09866a9db30fc647d1288a92
MD5 hash:
884e2c7e4b3ffd7528bcbfb8cb5fb0f9
SHA1 hash:
7583ffc5ec52904eadbae7d33dff7b53c39713eb
SH256 hash:
c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8
MD5 hash:
05d1c2995d41bfae991c4593ebcaeb53
SHA1 hash:
5bd1f44267d82e2255b7c035d05d38e44c7b3261
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | maldoc_find_kernel32_base_method_1 |
|---|---|
| Author: | Didier Stevens (https://DidierStevens.com) |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe c94ed463f55d967c0fb21e6e52efd3e94d0ad792e9d965f275265d6e5a285ea8
(this sample)
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.