MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5
SHA3-384 hash:	74bd87acde1e6df00055f518de31c27779da985ecc72562a868302c9245a48d473a3154c6f68f9b7ef01972598ab3819
SHA1 hash:	6e48ef72c5218c76b2a1524eadf282912f5a2b96
MD5 hash:	34836aa4eaf07b8ccf7d67817e2d9cdb
humanhash:	river-georgia-utah-hamper
File name:	SHIPPING DOCUMENT.exe
Download:	download sample
File size:	37'888 bytes
First seen:	2023-01-31 15:25:48 UTC
Last seen:	2023-02-11 23:25:42 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:BaJ45P5jHWSDAYsAY+WXcViup2D09VCBJifwi/30NZXggUX:BaSsi3s3+QcViND0zgJifT3CZwBX
Threatray	1'028 similar samples on MalwareBazaar
TLSH	T191033994A6AC8B33EBAF4B7E58F9558247BC5173E405EB0D388C50DD38D279302A235B
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	James_inthe_box
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

182

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SHIPPING DOCUMENT.exe

Verdict:

Malicious activity

Analysis date:

2023-01-31 15:27:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/6d30ed99-f618-4b73-84d3-ca36394c7b9d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/358699/

Detection(s):

SecuriteInfo.com.Trojan.DownLoaderNET.542.14745.28252.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file

Launching a process

Using the Windows Management Instrumentation requests

Reading critical registry keys

Creating a window

DNS request

Forced shutdown of a system process

Stealing user critical data

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

kryptocibule snake

Link:

https://www.filescan.io/uploads/63d9330c696b2d97257500d2/reports/8be6340a-b0b0-49e5-b610-7c5b53f67109/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d35066f2-1d85-4476-8e4a-cd2f9b902602

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl.evad

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1162525

Signature

.NET source code references suspicious native API functions

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5/

Threat name:

ByteCode-MSIL.Trojan.Tnega

Status:

Malicious

First seen:

2023-01-31 13:59:39 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3bvcedoww7q2iokhxyezvgztva322yiins6qbs5h44ylktflx7cq._file

Verdict:

malicious

36ce3b9ec0b50fcc219b1f1272363b8d3542b4afc3229e0251f58d9b27fb74e1

6326bea9cec6e2baec63ed96cd31a97770c6a63b96d1169a8b5586ec071c8778

65a2b3cf112d50e941051116e68b736239d521bf7611e143ae1c83f93716f6f5

8d7c1cb321e7b41dc11548e8a3e02c0394e50494b06d499e0465eb3919372d04

9a2232a4a9ceef2c3fcfee0acca71d5717395aff8abd1b6b26aa3a5c266b3fae

a7555fbbb59c9e063dfa6b392af01c02f1d23679e53882fc1cb6d3a432330c50

c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004

d4ee1c1713c6d964cdcf4b3d561322f78be458bc14b0c257b69eba2b441a07b6

+ 1'018 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

collection

Link:

https://tria.ge/reports/230131-st6rpsag4y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Uses the VBS compiler for execution

Unpacked files

SH256 hash:

d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5

MD5 hash:

34836aa4eaf07b8ccf7d67817e2d9cdb

SHA1 hash:

6e48ef72c5218c76b2a1524eadf282912f5a2b96

Link:

https://www.unpac.me/results/f35bf42f-2f37-41c0-b0e9-d7d3c73c18bb/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d86a220dd6b7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.