MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e
SHA3-384 hash:	71cc90c5c97a6cae239c7698e124c3485c2f5f3962f22d385fef190fa0bf9006c3b1fce0e42531c78c81fab65e17d636
SHA1 hash:	a3afd7531840274204f1655a2c994a0bc73386d9
MD5 hash:	ee2d9be8fc3f0244c44f57e16fb0646b
humanhash:	sad-monkey-alabama-nineteen
File name:	SecuriteInfo.com.Win32.DropperX-gen.4096.7937
Download:	download sample
File size:	2'252'800 bytes
First seen:	2023-12-22 14:14:23 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	c8624893d96fee216676930ae68b27a2
ssdeep	49152:Wty+RvZimcOJfAmuGvFM2/JaKCps+FokiiHB0PIRkp:AyMvMmp9vLsYXoXk
TLSH	T130A5F1393CB67045D2BF493600EB7BA8F36F50512AF755CA0C262D48E98B0A576783DE
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	SecuriteInfoCom
Tags:	dll

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

349

Origin country :

FR

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/469052/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.DropperX-gen.4096.7937.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

lolbin masquerade packed setupapi shell32

Link:

https://www.filescan.io/uploads/658599e77d4bdb7f8bfa5d1b/reports/78712da8-8383-4ba9-9375-7eb42ce172fb/overview

Hybrid Analysis Malware

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Raspberry Robin

Malware family:

Raspberry Robin

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/96f62331-c11a-4fd5-a3b5-15874b76ec90

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1366234

Signature

Antivirus / Scanner detection for submitted sample

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e/

ReversingLabs TitaniumCloud Win32.Trojan.Emotet

Threat name:

Win32.Trojan.Emotet

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-22 14:15:06 UTC

File Type:

PE (Dll)

AV detection:

18 of 23 (78.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zvhgty25rmph6bicylcnqjhdr6forj35tryacvdfmxh7gp47fyxa._file

Threatray malicious

Verdict:

malicious

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/231222-rkj1xabac9/

Behaviour

Suspicious use of WriteProcessMemory

UnpacMe

Unpacked files

SH256 hash:

cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e

MD5 hash:

ee2d9be8fc3f0244c44f57e16fb0646b

SHA1 hash:

a3afd7531840274204f1655a2c994a0bc73386d9

Link:

https://www.unpac.me/results/152ebe05-4e0b-41f7-8eb9-b1410c28d12d/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

dll cd4e69e35d8b1e7f0502c2c4d824e38f8ae8a77d9c7001546565cff33f9f2e2e

(this sample)

Cape

https://www.capesandbox.com/analysis/469052/

  

URLhaus

https://urlhaus.abuse.ch/url/2743501/

  

Delivery method

Distributed via web download