MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f482fbda511cae4b4f61ee797a6deb48af855fcc6d61acec87844578ea148ebe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f482fbda511cae4b4f61ee797a6deb48af855fcc6d61acec87844578ea148ebe
SHA3-384 hash: 0ba3be686ffdd76839bbdc860b5379b618bbe7023e79f51838e26038a691d4fbd618d1fff7a840f8c2ff4533d2520e84
SHA1 hash: aca8b6f8a9fe503ea248d505df1c0abcc7be9e74
MD5 hash: 771822d4f61302762ab1eff95afa2f25
humanhash: zulu-august-william-virginia
File name:f482fbda511cae4b4f61ee797a6deb48af855fcc6d61acec87844578ea148ebe
Download: download sample
File size:1'261'920 bytes
First seen:2020-11-07 19:15:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 467a9761a63d8c02691e80577de82ac3
ssdeep 24576:Fuu5eWdykSBLgdNxJMfonoUT6pXGZWRW7MG/RMZZe22Ue21N:kaOWdNonUT4+MRJ
TLSH 0A459CFA2776ABB2D49329F30F8C43C533E5793513AA859332D4560B43A96E3472C399
Reporter seifreed

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Adware.MultiPlug-6336421-1
Create hunting rule

Win.Trojan.Agent-1376316
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a UDP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
DNS request
Creating a window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f482fbda511cae4b4f61ee797a6deb48af855fcc6d61acec87844578ea148ebe/
Gathering data
Verdict:
unknown
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/201108-vta6zwnxsj/
Behaviour
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments