MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84
SHA3-384 hash: f0d65961f164ae576a537a7670a2ac35e25177471ff6a79c834d042bc664a19eabff4da6c04e818d030d676afa405601
SHA1 hash: 868fc4b515ea51cb9b36fa19f5c80688eb00048a
MD5 hash: 04deba0034c9627018780a3e1d6c17dd
humanhash: florida-apart-robert-september
File name:04deba0034c9627018780a3e1d6c17dd.exe
Download: download sample
File size:407'631 bytes
First seen:2024-09-02 05:54:54 UTC
Last seen:2024-09-02 06:50:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:O1ZTUKizefjOaN93UjLPfY97kciyuAp4mcFDH3Q+qkFh5RZ2FgH1fzcIi/RC2jV/:sFiiROvQ+XFZoUNU/RCN+8EseN7dqY
TLSH T12084F637629186BAD12C817FC1E2CD10E43B71B50737D9E765C1026AD788ED06E3AA6F
TrID 63.4% (.EXE) Win64 Executable (generic) (10523/12/4)
12.2% (.EXE) OS/2 Executable (generic) (2029/13)
12.0% (.EXE) Generic Win/DOS Executable (2002/3)
12.0% (.EXE) DOS Executable Generic (2000/1)
0.1% (.VXD) VXD Driver (29/21)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
344
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Win32.Delf.7592.15895.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66d55353a0c486d2f7940339
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
borland_delphi overlay packed
Link:
https://www.filescan.io/uploads/66d553466e29f44ae2a624de/reports/43017bc9-6334-49d7-b959-cf9a4c7ef70c/overview
Verdict:
Malicious
Labled as:
Trojan/Win64.SleepObf
Link:
https://www.hybrid-analysis.com/sample/f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Unlabeled
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cb750682-4bce-4171-a037-c1141012f3bf
Result
Threat name:
n/a
Detection:
unknown
Classification:
n/a
Score:
2 / 100
Link:
https://www.joesandbox.com/analysis/1502691
Behaviour
Behavior Graph:
Download SVG
Score:
11%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6aroxbk53gt5k6alioujw4hfsdsq2mf3sos7ye5lktajagam72ca._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240902-gmg9zstcpl/
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2bcec4e2-51b8-4236-8092-1e0d57be3577
Unpacked files
SH256 hash:
f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84
MD5 hash:
04deba0034c9627018780a3e1d6c17dd
SHA1 hash:
868fc4b515ea51cb9b36fa19f5c80688eb00048a
Link:
https://www.unpac.me/results/02013ff8-7974-4dac-8552-84223bad13c5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:Detect_Nimplant_PE
Create hunting rule
Author:daniyyell
Description:Detects malicious nimplant variant PE malware.
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f022eb855dd9a7d5780b43a89b70e590e50d30bb93a5fc13ab54c090180cfe84

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3145381/
  
Delivery method
Distributed via web download

Comments