MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 eac40fd435f76b232a9c9d583da3b218250de42c414ea64e2ff8e30cbf0a66fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | eac40fd435f76b232a9c9d583da3b218250de42c414ea64e2ff8e30cbf0a66fc |
|---|---|
| SHA3-384 hash: | d8450a2275a5f85f79ea524d6743b96db667e41422e4553c1f1d4e6f5eefcba5b4ea2984ef505671d61d36c94e6cc0cb |
| SHA1 hash: | a8ba830ef9f0bb55fb37cfb5f8e9501273388ef8 |
| MD5 hash: | 1452fd3d407c78a830df2c90ee20f223 |
| humanhash: | magazine-five-april-blossom |
| File name: | SecuriteInfo.com.Trojan.Zpevdo.2908.22984 |
| Download: | download sample |
| File size: | 8'835'152 bytes |
| First seen: | 2024-04-11 07:29:02 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 6d378b6ff06c71c5e5db2ed4c0703c08 (2 x Mirai, 1 x SimpleHelp) |
| ssdeep | 196608:GiO1lcSu5gTe3p2VLyM0/f7Pnj57ymavlb+nEz+JGjt:BfmTe52VGM2/j57ym2b+Ez5jt |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | T11C96331049E1E6F0CCA4767520AEA7338B3FE7E6670CBD079BB245907135299793B2C6 |
| TrID | 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | 72fcb0a2a0b0f07c (9 x SimpleHelp, 4 x Mirai, 1 x CobaltStrike) |
| Reporter |  SecuriteInfoCom |
| Tags: | exe signed |
Code Signing Certificate
| Organisation: | SimpleHelp Ltd |
|---|---|
| Issuer: | Thawte Code Signing CA - G2 |
| Algorithm: | sha1WithRSAEncryption |
| Valid from: | 2011-10-17T00:00:00Z |
| Valid to: | 2013-11-23T23:59:59Z |
| Serial number: | 56e4a1cfd00581c38393f9608e41a813 |
| Intelligence: | 8 malware samples on MalwareBazaar are signed with this code signing certificate |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | da35a0a9a2f6a1c8e085e027338cf59dce127bc23f8eeeb3d6fa49f5ab6fc261 |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
320
Origin country :
FRVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
eac40fd435f76b232a9c9d583da3b218250de42c414ea64e2ff8e30cbf0a66fc.exe
Verdict:
Malicious activity
Analysis date:
2024-04-11 07:29:22 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a window
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file in the %temp% subdirectories
Moving a file to the %AppData% subdirectory
Creating a file
Сreating synchronization primitives
Searching for synchronization primitives
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
fingerprint lolbin overlay packed remote
Verdict:
Suspicious
Labled as:
Trojan.Zpevdo
Malware family:
PeddleCheap
Verdict:
Malicious
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
27 / 100
Signature
Java source code contains very large array initializations
Submitted sample is a known malware sample
Behaviour
Behavior Graph:
Score:
28%
Verdict:
Benign
File Type:
PE
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
5ee1d7c1db8765d1f006e2ee2307a3bf828166d6ebfd86063e36bbe56dc99636
MD5 hash:
63a182417c812b5f060e5fcece06b0b7
SHA1 hash:
693c35ab5303cbcb6fef34f2191089f2604a9c86
SH256 hash:
48a537f401a35d5a89ff90ed26366c353f20d1e169cdb8e8f05c7d41a4b978a2
MD5 hash:
7c6280f2caa49673b38f6d13e45a1a54
SHA1 hash:
5a6187682b053c738682b72dcd07de505f4c796e
SH256 hash:
182cfc266189ebe9318dc7ecf229eba7a3417d447533b15d6167827c13e57ce0
MD5 hash:
b2c79618b5293ad8406ffb47cf3246c6
SHA1 hash:
5618a03c3dd441c713cc2df275bbf475d8257830
SH256 hash:
63b1f09cb848535e81c40f8f903ef4d373a60934dc808667aa2498071a28152d
MD5 hash:
5260dddeda768b12b0c1280cd6b9cd82
SHA1 hash:
44a7bf3e0d72818ac05c8bdaf54bf9cb0d054c27
SH256 hash:
0fd1a3dfea946dceca0830b63d2dae09be5fda5b7fef8d8a9fb84b95e84ee0c8
MD5 hash:
4f79f10b12b48e7d4b28213a9dad5719
SHA1 hash:
2f27cfe83c1eccc01d201061834146253dd51214
SH256 hash:
f48de1e5dabc406e2bca544152c81ac5d86d9ca65a164e9837eaf8b38b6cb6e3
MD5 hash:
f7b11bf660c7af3971667ebbd731a033
SHA1 hash:
280e42195eecbeaf7e7a90c56ac0e90aa1351a2f
SH256 hash:
0be8ba0e8fc5725f3db8235bbff96f9bc8c2e7657f1dae7d295533613b2c4ffe
MD5 hash:
faaeabef543a65f9bdf5f6f14580a19d
SHA1 hash:
1e9b47ce178b6df3f0f7b848b2a97ec12048d5f0
SH256 hash:
141fc4630b79acd278a806ee0ca7098f4023c0f5713aaa79eb1b41fe0ca06e43
MD5 hash:
7b4e0627cc1510b4a83d805974b299cc
SHA1 hash:
e9b8515ac36c3aa29d273dc4d45c02c211bf5c2d
SH256 hash:
919041903682dd7fbf70a237a8c120ee12966b06ae49e4295b2eb3e807c1d7c0
MD5 hash:
0d3c5b48cf7ef5c02301d463de95412d
SHA1 hash:
7184a3d971d711f4c185a508bd7d71b1717eac0a
SH256 hash:
657d19e560ac1cae79e1ba0541ccbb8541142ca17ef90a372ef8058fcba98701
MD5 hash:
5785027d1b7a6350a8768294341b0f74
SHA1 hash:
8144e39f0e70e9065d471021abcb963f9c03dde5
SH256 hash:
02070e875f9895facfcc1fb780fee59eb9c0196ffdf8891c6e718f65b483409b
MD5 hash:
651c24a8805f1e69ccd72bd1476db9ca
SHA1 hash:
3c1a3fc3648dea3d87e5ebba4052030a7e7ff1bf
SH256 hash:
f16b39ef342323d997b2cc9b649a94b6ebd12954671f357d1ed690bd7eb5ba7f
MD5 hash:
71dc11c495355f883498ff5e8702bb3d
SHA1 hash:
9685190619088991a89ab6b96f8595453bb7f795
SH256 hash:
f80b62d08b37f5a170744fae16f31f0bb07363166feb25758accd3b854ee24af
MD5 hash:
e776c9fdd97c431fcf2fa133c7902f8e
SHA1 hash:
9a2be11fc2a0fadd990adc802d7b2b5a0d4e4edf
SH256 hash:
e00b4b5587a946256e79215559f510c8493da037d605d7f89f0c55cc6de45771
MD5 hash:
4b74c147a5d52efac7a8a91a8f6dc4e1
SHA1 hash:
8909a1c26d9add942bb8e00f81300c96c293f84b
SH256 hash:
df83f29995cdaae293b53a73e994b4c239b56ca3e721810dd43fc8cde6557dac
MD5 hash:
9387a10c5d905f3b6a076cdacb240701
SHA1 hash:
c65a54479586804b2ee00c78ad12985c0e1087a7
SH256 hash:
4f8321ec57130179586bf173de195c2685b80aa2647e1c4d735b12a79e5efba7
MD5 hash:
cf157a9e8109a0830978250de641679f
SHA1 hash:
c16629cba8fd599feb1137e25ee49ab4f26f25ad
SH256 hash:
f36734c49d6ed2e74cf0fd4474d58e6533c31ec3e76d5b75f8ba74019879739a
MD5 hash:
614f95b254544bc869e54ed2fcc6624f
SHA1 hash:
be9b8789f8dc93d04269d84e3107b853da3e4274
SH256 hash:
eac40fd435f76b232a9c9d583da3b218250de42c414ea64e2ff8e30cbf0a66fc
MD5 hash:
1452fd3d407c78a830df2c90ee20f223
SHA1 hash:
a8ba830ef9f0bb55fb37cfb5f8e9501273388ef8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | PE_Potentially_Signed_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| GDI_PLUS_API | Interfaces with Graphics | gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipFillRectangleI gdiplus.dll::GdipDeleteBrush gdiplus.dll::GdipAlloc |
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CreateProcessA WININET.dll::InternetCloseHandle WINHTTP.dll::WinHttpCloseHandle KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetDriveTypeA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::WriteConsoleW KERNEL32.dll::WriteConsoleA KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleOutputCP KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateDirectoryA KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA KERNEL32.dll::MoveFileA KERNEL32.dll::FindFirstFileA |
| WIN_HTTP_API | Uses HTTP services | WINHTTP.dll::WinHttpGetIEProxyConfigForCurrentUser WINHTTP.dll::WinHttpGetProxyForUrl WINHTTP.dll::WinHttpOpen |
| WIN_USER_API | Performs GUI Actions | USER32.dll::PeekMessageA USER32.dll::CreateWindowExA |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.