MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4
SHA3-384 hash: 5af932ddc86458aeb925cf1f729675c87cd062ddcf0a44e1525ec133389af72d1f63535816b23cf2e991b7d064868a87
SHA1 hash: 95e0fb211f31673dd6f9f4e74360b184250d3fde
MD5 hash: ec15ab6bec865de98d39f4ab8e73fe1b
humanhash: may-black-three-october
File name:Purchase Order.exe
Download: download sample
File size:630'272 bytes
First seen:2023-01-24 21:37:14 UTC
Last seen:2023-07-18 18:34:54 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 12288:OmCglZ6MneQ8/aR/O11EqQNIAW8FzQS/dlf2XwE7jo9av/Ksq/Ks6/Ks:tRKAKihcYNrWKQkddW/3OOiS
Threatray 996 similar samples on MalwareBazaar
TLSH T13CD402C2329881A3F97C56B1A7735DB002653F198FAAEF8E1CA5355324F33618459E3B
TrID 56.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.0% (.ICL) Windows Icons Library (generic) (2059/9)
10.9% (.EXE) OS/2 Executable (generic) (2029/13)
10.7% (.EXE) Generic Win/DOS Executable (2002/3)
10.7% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 9aa28a92b6a08e8e (5 x LgoogLoader, 2 x Formbook, 2 x AgentTesla)
Reporter James_inthe_box
Tags:exe

Intelligence

File Origin
# of uploads :
6
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Purchase Order.exe
Verdict:
Malicious activity
Analysis date:
2023-01-24 21:39:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4984af50-b2c9-4e0b-b957-bf27727bf25e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/356551/
Detection(s):
Sanesecurity.Rogue.0hr.20230125-0033.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Launching a process
Creating a file
Using the Windows Management Instrumentation requests
Reading critical registry keys
Creating a window
DNS request
Sending a custom TCP request
Forced shutdown of a system process
Stealing user critical data
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
msiexec.exe packed
Link:
https://www.filescan.io/uploads/63d04fbc1c9cbf7d625231b3/reports/02f9f955-cc15-4f94-be5a-6d1e880804f2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3da0b86c-75f9-4344-848a-1bcedaa0732d
Result
Threat name:
Unknown
Detection:
malicious
Classification:
expl.evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1158329
Signature
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM3
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 791066 Sample: Purchase Order.exe Startdate: 24/01/2023 Architecture: WINDOWS Score: 80 19 Malicious sample detected (through community Yara rule) 2->19 21 Yara detected UAC Bypass using CMSTP 2->21 23 Yara detected AntiVM3 2->23 25 4 other signatures 2->25 6 Purchase Order.exe 3 2->6         started        process3 file4 17 C:\Users\user\...\Purchase Order.exe.log, CSV 6->17 dropped 9 ServiceModelReg.exe 6->9         started        11 aspnet_regsql.exe 6->11         started        13 SMSvcHost.exe 6->13         started        15 28 other processes 6->15 process5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2023-01-24 21:36:35 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
19
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6vwi4gl3xzkrsqvx4amaqzdldtf3ahunip6cxi7fuyax4qhi4hka._file
Verdict:
malicious
Similar samples:
41955ff332c22ffa3c2014f4bdffc2db6b5ae75d8289df443929a507dca525cd
65a2b3cf112d50e941051116e68b736239d521bf7611e143ae1c83f93716f6f5
67388fca813133367167001c4114d6cd97b4bed24d0acdfda8b5784723a698ea
67ffb10d7ef8cc9b49ef3ad7affcd7f865391cac2cdbad7ae1d259ec6a4a0cb8
6cfc4dfd10e4a160e8d70e9a8178288daff0ec49e39dd5f45f9ea553b94b4a8f
901112dd590ebf7bb0314c090a66522540e27d7ae769f2030ac47e3046f5d313
bac6488f76da4691540401614bc665dfc5bec8d875cb26e72870c65ac43fe268
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
+ 986 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection
Link:
https://tria.ge/reports/230124-1g2k8afe7s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4
MD5 hash:
ec15ab6bec865de98d39f4ab8e73fe1b
SHA1 hash:
95e0fb211f31673dd6f9f4e74360b184250d3fde
Link:
https://www.unpac.me/results/a1da7f31-d3e9-40a7-96f2-69c3191656ff/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f56c8e197bbe/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 818e0bab11bfd5cd7c55356efce17fe8c2024a193d968cfb18f70d15a0d12951

Executable exe f56c8e197bbe551942b7e01808646b1ccbb01e8d43fc2ba3e5a6017e40e8e1d4

(this sample)

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/356551/
  
Dropped by
SHA256 818e0bab11bfd5cd7c55356efce17fe8c2024a193d968cfb18f70d15a0d12951
  
Dropped by
MD5 cc5b16d73491511b74c196b841d9b7fb

Comments