MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7
SHA3-384 hash: 102e1c6fb148c726814dfb0ad6c757ce16b292c430f3a0fe77d84e0db1065c8b6a197d20123c433461230fc052de135d
SHA1 hash: 39ae8ba8c5280a09ba638df4c9d64ac0f3f706b6
MD5 hash: 45a1ac6973b95ecfd20bc18f35a68f18
humanhash: uncle-emma-winner-salami
File name:file
Download: download sample
File size:310'440 bytes
First seen:2024-01-16 16:36:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ad501347658d973b4e2cfc18237277b
ssdeep 6144:vEzEWQwlMQUAWiiuTOBo46XSuwPMDOw0w1t7s3kms15q:vEzn5MoW/8SM/zq
TLSH T140644A5573E800E8F5B396348D728501EA777C565B34D78F03A8826E6F73A909E39B32
TrID 70.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.9% (.EXE) Win64 Executable (generic) (10523/12/4)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.5% (.ICL) Windows Icons Library (generic) (2059/9)
2.4% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter jstrosch
Tags:exe signed X64

Code Signing Certificate

Organisation:Microsoft Corporation
Issuer:Microsoft Code Signing PCA
Algorithm:sha1WithRSAEncryption
Valid from:2015-06-04T17:42:45Z
Valid to:2016-09-04T17:42:45Z
Serial number: 330000010a2c79aed7797ba6ac00010000010a
Intelligence: 13 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 67c529ad57b2aedd4d248993324270c7064d4f6bdaaf70044d772d05c56001a4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
jstrosch
Found at hxxp://121.37.198[.]25:8287/11/dump.exe by #subcrawl

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
p64.exe
Verdict:
No threats detected
Analysis date:
2022-03-28 10:08:09 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/280f1fd3-3224-4a4f-890c-f9b864f80f03

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/471180/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd control evasive lolbin overlay packed shell32
Link:
https://www.filescan.io/uploads/65a6b0b8e1815911f169ccb3/reports/f82f1524-f203-4586-bab9-fc9952b38236/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7
Malware family:
Sysinternals
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/b71a3f87-4b18-4728-9128-ab519925c1fb
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
26 / 100
Link:
https://www.joesandbox.com/analysis/1375552
Signature
Contains functionality to prevent local Windows debugging
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 process2 2 Behavior Graph ID: 1375552 Sample: file.exe Startdate: 16/01/2024 Architecture: WINDOWS Score: 26 5 file.exe 1 1 2->5         started        signatures3 10 Contains functionality to prevent local Windows debugging 5->10 8 conhost.exe 5->8         started        process4
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6tednhsn4hyszrnhd22vq2zy7r4ktwg3fmmjxdbf54l2k4wu223q._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/240116-t4s42afhb8/
Unpacked files
SH256 hash:
f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7
MD5 hash:
45a1ac6973b95ecfd20bc18f35a68f18
SHA1 hash:
39ae8ba8c5280a09ba638df4c9d64ac0f3f706b6
Link:
https://www.unpac.me/results/fa0d58cc-b239-41d5-851f-afa431893810/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Active
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe f4c8369e4de1f12cc5a71eb5586b38fc78a9d8db2b189b8c25ef17a572d4d6b7

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/471180/

Comments