MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e11a9404b163f3674bed28b2ee29c78464e6221b8b05a4727dbea1d29a8b3e00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | e11a9404b163f3674bed28b2ee29c78464e6221b8b05a4727dbea1d29a8b3e00 |
|---|---|
| SHA3-384 hash: | ae3e3dd3320a5f1dc2f514af2a54490568810d5b377c85c659a5fe36d3cd698305798d76586f72cddb95bedc1c49bcf1 |
| SHA1 hash: | 0584480efc9e1d5a427420789e708a62ec7f91d2 |
| MD5 hash: | 8f226460531c82056fa514d40ba96964 |
| humanhash: | crazy-red-twenty-november |
| File name: | Stake Predictor.exe |
| Download: | download sample |
| File size: | 299'072 bytes |
| First seen: | 2025-04-01 00:05:31 UTC |
| Last seen: | 2025-04-01 11:58:29 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger) |
| ssdeep | 3072:ZKqYTvC5Bs/mTfSfhFLTY6RBWsWDsvs5xgVqaQse/NXyHrzGqY60q:wqevC5ByAn1IsbgVYselXyHrCqD |
| TLSH | T131540F9A03214DB3C542173498AC7FAC413A0FF2B5F9DFCD792139666D89BC26C32A65 |
| TrID | 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.2% (.EXE) Win64 Executable (generic) (10522/11/4) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Magika | pebin |
| dhash icon | a294dec8d49ebb41 |
| Reporter |  aachum |
| Tags: | exe jmutanen software Oy signed |
Code Signing Certificate
| Organisation: | jmutanen software Oy |
|---|---|
| Issuer: | SSL.com EV Code Signing Intermediate CA RSA R3 |
| Algorithm: | sha256WithRSAEncryption |
| Valid from: | 2025-03-03T17:10:55Z |
| Valid to: | 2026-03-03T17:10:55Z |
| Serial number: | 5d0f3064fc92cc703ef200ca9c344f56 |
| Intelligence: | 18 malware samples on MalwareBazaar are signed with this code signing certificate |
| Cert Graveyard Blocklist: | This certificate is on the Cert Graveyard blocklist |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | 822ef8b22669c1721f29c194b8eff2de3beb2598a567e38f4e57c35ca2475089 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
iamaachum
https://sourceforge.net/projects/stake-predictor/Loads the ScreenConnect .msi inside of the requirements folder in the .zip file which has this PE. ScreenConnect installer shares the same certificate.
Intelligence
File Origin
# of uploads :
2
# of downloads :
489
Origin country :
ESVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Stake Predictor.exe
Verdict:
No threats detected
Analysis date:
2025-04-01 00:08:43 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
94.1%
Tags:
shellcode dropper remo
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
lolbin msiexec obfuscated signed
Verdict:
Suspicious
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Behaviour
Behavior Graph:
n/a
Score:
85%
Verdict:
Malware
File Type:
PE
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery
Behaviour
Program crash
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
e11a9404b163f3674bed28b2ee29c78464e6221b8b05a4727dbea1d29a8b3e00
MD5 hash:
8f226460531c82056fa514d40ba96964
SHA1 hash:
0584480efc9e1d5a427420789e708a62ec7f91d2
SH256 hash:
7c8f2a2ffbe4da5c85f2c764b988feceaed2b7fb21049196e8c014fdf9ee934c
MD5 hash:
1e1a03c1926def157aba3d0c5c116604
SHA1 hash:
d69e4a2fb990142cff4831777e3f57142a934bf0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.12
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | NETexecutableMicrosoft |
|---|---|
| Author: | malware-lu |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_Obf_Enc_Spoof_Hide_PE |
|---|---|
| Author: | XiAnzheng |
| Description: | Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe e11a9404b163f3674bed28b2ee29c78464e6221b8b05a4727dbea1d29a8b3e00
(this sample)
Delivery method
Distributed via web download
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (GUARD_CF) | high |
| CHECK_TRUST_INFO | Requires Elevated Execution (level:requireAdministrator) | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.