MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 dd10da537068ac4f365cd9eb6bbaba113d20f00d6d20e17293a941c88fac8214. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | dd10da537068ac4f365cd9eb6bbaba113d20f00d6d20e17293a941c88fac8214 |
|---|---|
| SHA3-384 hash: | b538a0e176f8fd83a434332c98d0213117ebd54be0e5ea97eb271fc3e59c2618e8a2600c23bd0ca3db8b4322e3a3fcaa |
| SHA1 hash: | c069d2dc5f7783fd0fa11bd357593e3c001daaa9 |
| MD5 hash: | edba371fc961a2f4519f533f88f2c37a |
| humanhash: | salami-carpet-emma-apart |
| File name: | adm_atu.exe |
| Download: | download sample |
| File size: | 6'200'451 bytes |
| First seen: | 2025-02-21 23:05:32 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4b8ea275b01195301d047f45b8ba14d3 |
| ssdeep | 98304:CPJbiYJEWQr3AkrJ0bAo8RoIqZN3lQjeZJJP2Omj8Sste0AbD5ZF+9xT76MOs/cN:0lii3QbhVqesZTZ+84Zk9xSm/pBC2S |
| TLSH | T1DA563315C5AFDEEDF552FEFE1B739809AD5249EC0AE226E120C4005C93F2B61353887A |
| TrID | 34.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 34.1% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4) 8.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.7% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 69e0cc8edcdcd871 |
| Reporter |  skocherhan |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
27
Origin country :
GBVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
dd10da537068ac4f365cd9eb6bbaba113d20f00d6d20e17293a941c88fac8214.exe
Verdict:
No threats detected
Analysis date:
2025-02-22 00:49:25 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
95.7%
Tags:
shellcode injection corrupt
Result
Verdict:
Clean
Maliciousness:
Behaviour
Delayed reading of the file
Creating a file in the %temp% directory
Creating a window
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
microsoft_visual_cc obfuscated overlay packed packed packed packer_detected upx
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
22 / 100
Signature
Found stalling execution ending in API Sleep call
Behaviour
Behavior Graph:
Score:
75%
Verdict:
Malware
File Type:
PE
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
5/10
Tags:
discovery upx
Behaviour
System Location Discovery: System Language Discovery
UPX packed file
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
dd10da537068ac4f365cd9eb6bbaba113d20f00d6d20e17293a941c88fac8214
MD5 hash:
edba371fc961a2f4519f533f88f2c37a
SHA1 hash:
c069d2dc5f7783fd0fa11bd357593e3c001daaa9
SH256 hash:
12febfcda633e31cf77e5e1496c219e063963967120eb642c73a0ca1422d503c
MD5 hash:
3567b392a69f9393f55f45322c3c7f4e
SHA1 hash:
f020b886c3c633e19a1235da0a31b64e4fa91e88
SH256 hash:
15c5ac3a126f1d5522351322760bc9c6238a842b5c1e6d6cc2e6786ac3223fab
MD5 hash:
e422850795c697d8301f21588c159671
SHA1 hash:
ad097b0a2335749c48e77e47ecf2e873df84149f
SH256 hash:
7b0bdb4a1dcd92a71f83c81c761afbb58f5e35c2c89dbdf3f22579a54ff104cb
MD5 hash:
27373098bd613c24b6ae88ba6338b457
SHA1 hash:
9265c6f77f1ad63cdc12ec767573b2d12345bc80
SH256 hash:
e58f4db5423aa3ec3209b9dd46bc09a467f92f517e1093b9b51e27c721bdf895
MD5 hash:
2d5a8291b5934a7851e0ff21e9f1299d
SHA1 hash:
0136b0ac3f2f8959be14fcf63e748f1e25cf1ca6
SH256 hash:
91e4dea20eb035f2dddbeff9c7e1eae181ca0a9fcf1ebe1e959bc1d89d339c3a
MD5 hash:
6b6e611ff2f47ca513d03af96a260758
SHA1 hash:
422ab1e117a5c3d0e58a15e71a8e9e17bfc6e476
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
| Rule name: | UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_3 |
|---|---|
| Author: | Kevin Falcoz |
| Description: | UPX 3.X |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe dd10da537068ac4f365cd9eb6bbaba113d20f00d6d20e17293a941c88fac8214
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| SHELL_API | Manipulates System Shell | SHELL32.dll::ShellExecuteA |
| WIN_BASE_API | Uses Win Base API | KERNEL32.DLL::LoadLibraryA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.