MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eee468bff615adfd8c7b6afc3dc8d064e5076e6175e7d28e233983e08a0a4426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eee468bff615adfd8c7b6afc3dc8d064e5076e6175e7d28e233983e08a0a4426
SHA3-384 hash: 7bc757f7202b7029abf96e23bb97f820ac19a62d25b3a0f25637a47214418387fcd75f9bbcf3965800fbe50b6253061d
SHA1 hash: af1b3d2d94dab292f4f4d35aa3f9ca8cea790b27
MD5 hash: 45def3e14f4088ddf206367347511705
humanhash: jupiter-cardinal-cat-nine
File name:eee468bff615adfd8c7b6afc3dc8d064e5076e6175e7d28e233983e08a0a4426
Download: download sample
Signature HawkEye
Create hunting rule
File size:811'008 bytes
First seen:2020-03-23 15:57:48 UTC
Last seen:2020-03-23 16:17:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 46978de0f8944a65af1673d613222a98 (5 x Smoke Loader, 5 x Vjw0rm, 3 x FormBook)
ssdeep 24576:ANR2zaQBt37/CZ0w1PeWnzqhqCC6+PEfs:lUsrC6aEk
Threatray 38 similar samples on MalwareBazaar
TLSH DA057C12B3D3D1B7EF6225F2C6B543321939F838073CA6DB7390292EE9906C16A75359
Reporter Marco_Ramilli
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Autohk-6837349-0
Create hunting rule

Win.Dropper.LokiBot-6986983-0
Create hunting rule

Win.Dropper.LokiBot-6987287-0
Create hunting rule

Win.Malware.Autohk-6995517-0
Create hunting rule

PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Autohk
Create hunting rule
Status:
Malicious
First seen:
2018-11-06 12:43:45 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
23 of 30 (76.67%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
2ba0f2e22ed07ca3188c898a0c9256fd30e878916ebe669ed52b25cb18d5ccde
HawkEye
3afe4dd1466eb99bc7ab905a2363173dc043f9060982c49b6f5da73293f7d6ed
HawkEye
65c86813da2eb5bfc495e538fa4e77f8c3a3c03418e655ac8262bc0aa42281ba
HawkEye
693626ad4ce750ecb027980dfb505ca69872923702dfe564e0adcb651e8c60d9
HawkEye
6c90f16a6932be921cbb44b9e4531cf36e5ded6d5dd0016c4309a56ab8a96461
HawkEye
c6d5e1fdae2634a3a2a29a8c5de69f725ebceefba86d3700bc922aac7f55a1f7
HawkEye
cb663a4fa79cb0fcb52c3049b65b1a012c45e72badc13c931fc2c72a8a94dcca
HawkEye
e37b9f443aeeb7bc508a9805354e0a91593d00536f61810eccaafbd9e325e347
HawkEye
e971ff222148de51a5cb8aa8648b76b727179bd39bd2e01b5824c9e752fcf147
HawkEye
eecf5fa7aabf91128e8b3d5a6b6541ccc4e379c18cfe1d35f2473740a192e8d1
HawkEye
+ 28 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

HawkEye

Executable exe eee468bff615adfd8c7b6afc3dc8d064e5076e6175e7d28e233983e08a0a4426

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/74958/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaWINMM.dll::joyGetDevCapsW
WINMM.dll::joyGetPosEx
WINMM.dll::mciSendStringW
WINMM.dll::mixerClose
WINMM.dll::mixerGetControlDetailsW
WINMM.dll::mixerGetDevCapsW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::AdjustTokenPrivileges
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::SHFileOperationW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessW
KERNEL32.dll::OpenProcess
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryExW
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetVolumeInformationW
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleW
KERNEL32.dll::SetStdHandle
KERNEL32.dll::GetConsoleCP
KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::MoveFileW
KERNEL32.dll::GetWindowsDirectoryW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::GetUserNameW
ADVAPI32.dll::LookupPrivilegeValueW
KERNEL32.dll::QueryDosDeviceW
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegConnectRegistryW
ADVAPI32.dll::RegCreateKeyExW
ADVAPI32.dll::RegDeleteKeyW
ADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::UnlockServiceDatabase
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuW
USER32.dll::CreateMenu
USER32.dll::EmptyClipboard
USER32.dll::FindWindowW
USER32.dll::OpenClipboard
USER32.dll::PeekMessageW

Comments