MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e
SHA3-384 hash: 02ce8c53182859cf9365a37248d51b5ae92a97dc671f062c2b1db6461f1048c1f034edcb5b005f522f88cceb5bf1fee7
SHA1 hash: 18c46e1592a91bc03b7594848358e698d43658af
MD5 hash: 575f4671a263ae52747363214b38939e
humanhash: eleven-winner-yankee-coffee
File name:gldfibhrfn.exe
Download: download sample
File size:7'824'120 bytes
First seen:2024-08-06 15:59:38 UTC
Last seen:2024-08-06 16:29:36 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 423c12638e7a673ae27fc28ec0245398
ssdeep 49152:L76WdPYhcV8LFMlBo+6PndG/mOJ/SbFyWWYSTBZ51ZOTLUGQuZmGNVPiyoN1PWa9:L7TY62PvLBx8qUH
Threatray 30 similar samples on MalwareBazaar
TLSH T19076387F32A48268C25ED13EC0B78F44D933757E1B33C6E742A106A84B569C69E7F660
TrID 77.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
14.1% (.EXE) Win64 Executable (generic) (10523/12/4)
2.7% (.EXE) OS/2 Executable (generic) (2029/13)
2.6% (.EXE) Generic Win/DOS Executable (2002/3)
2.6% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 88ce7ab4e0f03203
Reporter smica83
Tags:exe Quanzhou Chunsheng Technology Co Ltd signed

Code Signing Certificate

Organisation:Quanzhou Chunsheng Technology Co., Ltd.
Issuer:Certum Extended Validation Code Signing 2021 CA
Algorithm:sha256WithRSAEncryption
Valid from:2024-07-26T06:48:31Z
Valid to:2025-07-26T06:48:30Z
Serial number: 417b3a9c446891f15b00caeb70d95cb6
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: c2f7495f7dbe74442c0a6b8511908de4e82a658df059b256e50f29ba76d481c3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
384
Origin country :
HU HU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win64.DropperX-gen.14300.19946.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66b24889aa5b40be0a9fafbb
Tags:
Encryption Execution Network Static Stealth Trojan Heur
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %temp% subdirectories
Launching cmd.exe command interpreter
Creating a process with a hidden window
Creating a process from a recently created file
Connecting to a non-recommended domain
Connection attempt
Setting a global event handler for the keyboard
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
embarcadero_delphi fingerprint keylogger overlay packed
Link:
https://www.filescan.io/uploads/66b2488784afcda9626589aa/reports/1001b16d-5d3f-43ba-8735-7826a3ca72cd/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/36729dc2-8509-41ac-84cb-75216ceb1f2e
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1488746
Signature
AI detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1488746 Sample: Advanced_IP_Scanner_2.5.45.exe Startdate: 06/08/2024 Architecture: WINDOWS Score: 60 24 Multi AV Scanner detection for submitted file 2->24 26 AI detected suspicious sample 2->26 7 Advanced_IP_Scanner_2.5.45.exe 4 2->7         started        10 gldfibhrfn.exe 2->10         started        process3 file4 20 C:\Users\user\AppData\...\gldfibhrfn.exe, PE32+ 7->20 dropped 12 cmd.exe 1 7->12         started        process5 process6 14 gldfibhrfn.exe 1 12->14         started        18 conhost.exe 12->18         started        dnsIp7 22 91.202.233.161, 443, 49716, 57582 M247GB Russian Federation 14->22 28 Multi AV Scanner detection for dropped file 14->28 signatures8
Score:
27%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-08-05 13:40:02 UTC
File Type:
PE+ (Exe)
Extracted files:
16
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2eklygjc5yiya7trsawf5fcbzzpmpkd5b7fdarodymczvbmtwapa._file
Verdict:
malicious
Similar samples:
4640d425d8d43a95e903d759183993a87bafcb9816850efe57ccfca4ace889ec
5e295c03710685077aad8d1572902cf8e265d683eb0821f1c34e7765fc8dfa1f
b5ab21ddb7cb5bfbedee68296a3d98f687e9acd8ebcc4539f7fd234197de2227
d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e
d9db8cdef549e4ad0e33754d589a4c299e7082c3a0b5efdee1a0218a0a1bf1ee
f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
+ 20 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240806-tfmx4stbmq/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/25682be1-2efb-4a9a-8d3f-37c976f3b39a
Unpacked files
SH256 hash:
d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e
MD5 hash:
575f4671a263ae52747363214b38939e
SHA1 hash:
18c46e1592a91bc03b7594848358e698d43658af
Link:
https://www.unpac.me/results/d945ce96-1682-4731-9b5d-3e21d6d49a66/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d114bc1922ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d114bc1922ee11807e71902c5e9441ce5ec7a87d0fca3045c3c3059a8593b01e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
MULTIMEDIA_APICan Play Multimediagdi32.dll::StretchDIBits
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExW
kernel32.dll::LoadLibraryA
kernel32.dll::LoadLibraryW
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoW
kernel32.dll::GetDiskFreeSpaceW
WIN_BASE_EXEC_APICan Execute other programskernel32.dll::GetConsoleOutputCP
kernel32.dll::GetConsoleCP
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileW
kernel32.dll::GetFileAttributesW
kernel32.dll::FindFirstFileW
version.dll::GetFileVersionInfoSizeW
version.dll::GetFileVersionInfoW
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegConnectRegistryW
advapi32.dll::RegCreateKeyExW
advapi32.dll::RegDeleteKeyW
advapi32.dll::RegLoadKeyW
advapi32.dll::RegOpenKeyExW
advapi32.dll::RegQueryInfoKeyW
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::EmptyClipboard
user32.dll::FindWindowExW
user32.dll::FindWindowW
user32.dll::OpenClipboard

Comments