MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 26 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
SHA3-384 hash: 7bf6ac81c3e4f0e2616ae636b7ce1b3531bdd9ac7313dc9fe6173f58d276a610029041a33ca2dd938e20fd0cae35adc9
SHA1 hash: 467d3da8b2fa7ff0d2958d30c3345c109647e09d
MD5 hash: 8d76bb0011099f752d1df93ad3f697f2
humanhash: fruit-princess-mountain-skylark
File name:wps_wid.cid-735916525.1730301987.exe
Download: download sample
File size:5'806'976 bytes
First seen:2024-10-30 15:30:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 26ba65d1a9fc9fd7f8842f912062f241
ssdeep 98304:irI1lEAOYB6RJ2dqW8LZJc+ZQSAA4zJOi6f4s9w0dGzB/vr:RXGULEFrcPJzAxf4+FGVD
TLSH T10C46B012F78694F1E5C101F024BAABBA5C3DAA29573589C3D7E11D2984302D37E3BB5E
TrID 68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.5% (.EXE) Win64 Executable (generic) (10522/11/4)
6.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.3% (.EXE) Win32 Executable (generic) (4504/4/1)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon d8ccb2aa8e9694c4 (5 x AgentTesla, 1 x AuroraStealer, 1 x Floxif)
Reporter Fuzzy
Tags:exe signed

Code Signing Certificate

Organisation:Zhuhai Kingsoft Office Software Co., Ltd.
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2024-07-24T00:00:00Z
Valid to:2025-06-24T23:59:59Z
Serial number: 0d1b24b68f3741034b9b1151c59ed692
Thumbprint Algorithm:SHA256
Thumbprint: cb1b68b39ac9e5fb92dbed413b19bf949d82610a6f16cc59e249801821942b65
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
458
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
https://kso.page.link/wps
Verdict:
Suspicious activity
Analysis date:
2024-10-30 03:55:06 UTC
Tags:
qrcode maldoc-17
Link:
https://app.any.run/tasks/877c395f-9161-48ea-b107-ac3491895124

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6722513c8d23d9049131fc52
Tags:
shellcode vmdetect dropper smtp
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Searching for synchronization primitives
Sending a custom TCP request
Creating a file in the %AppData% subdirectories
Sending an HTTP GET request
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm anti-vm chacha datper expand explorer fingerprint lolbin microsoft_visual_cc obfuscated packed packed packer_detected rijndael whirlpool
Link:
https://www.filescan.io/uploads/672251387b6de3d3d356a406/reports/d4e04637-25de-4fc0-9c73-bad26f09bfca/overview
Verdict:
Suspicious
Link:
https://www.hybrid-analysis.com/sample/d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Kingsoft Corporation
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/625fb33f-7a33-41f7-9745-68e61db1d3b6
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
26 / 100
Link:
https://www.joesandbox.com/analysis/1545519
Signature
Contains functionality to infect the boot sector
Drops large PE files
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Behaviour
Behavior Graph:
Download SVG
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2gp6qubwx2mlot77m65uhbslkhaoo5ailwvmf6qjummcvtyi45za._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit discovery evasion persistence privilege_escalation trojan
Link:
https://tria.ge/reports/241030-sx2bdswgnq/
Behaviour
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks whether UAC is enabled
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks installed software on the system
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Checks computer location settings
Event Triggered Execution: Component Object Model Hijacking
Writes to the Master Boot Record (MBR)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/0f3e3419-2e45-48ee-b361-8a0505e14409
Unpacked files
SH256 hash:
d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772
MD5 hash:
8d76bb0011099f752d1df93ad3f697f2
SHA1 hash:
467d3da8b2fa7ff0d2958d30c3345c109647e09d
Link:
https://www.unpac.me/results/4da94695-601d-4033-9b72-c93e1fc4f933/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d19fe85036be98b74fff67bb43864b51c0e774085daac2fa09a3182acf08e772

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agent_BTZ
Create hunting rule
Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:ComRAT
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::OpenProcess
KERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::CreateFiber
KERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryExA
KERNEL32.dll::LoadLibraryExW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::ReadConsoleA
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetConsoleMode
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileW
KERNEL32.dll::DeleteFileA

Comments