MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb
SHA3-384 hash:	437b9a0fb73bd3679702a53c0e80a1df7fb5536b5811878ac9315981d806f11b79d99c2dd68f70b6c3a7ab2c8888b4c3
SHA1 hash:	dcd8bb51fa34a48738b28e6075c458d4457047eb
MD5 hash:	fba8a40ecfce8a57d55dc5c49219c806
humanhash:	fruit-paris-coffee-mississippi
File name:	2466475588.pdf.bat
Download:	download sample
Signature	MassLogger Alert Create hunting rule
File size:	207'644 bytes
First seen:	2025-03-27 15:34:44 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	6144:1jkQ3MlccHAVexOMjuIYoU441DvLHfxa9L4Hdj:9kQ3MlccHAVexOMjE441DvLHfhdj
Threatray	737 similar samples on MalwareBazaar
TLSH	T1B2147D3FE3EAFCC14F74A0CB685CA70E11C86A03B1AC9B5CD556055322BEA258BF651D
Magika	vba
Reporter	James_inthe_box
Tags:	bat MassLogger

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

99

Origin country :

US

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

2466475588.pdf.uue

Verdict:

Malicious activity

Analysis date:

2025-03-28 01:16:25 UTC

Tags:

arch-exec snake keylogger evasion stealer

Link:

https://app.any.run/tasks/305eb3d1-8e23-419b-88b7-f77883058b9b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

ClamAV Detected

Detection(s):

SecuriteInfo.com.BAT.Agent-36.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e5723dc471d02ff53e033e

Tags:

shell spawn sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

masquerade obfuscated

Link:

https://www.filescan.io/uploads/67e57049631830704a8944be/reports/1e76d869-2cfd-4382-8e8b-fa460bcb1c81/overview

Hybrid Analysis Trojan/BAT.Obfuscated

Verdict:

Malicious

Labled as:

Trojan/BAT.Obfuscated

Link:

https://www.hybrid-analysis.com/sample/fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox Batch Injector, MSIL Logger, MassLogger

Result

Threat name:

Batch Injector, MSIL Logger, MassLogger

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1650361

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: PowerShell Base64 Encoded Invoke Keyword

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected Batch Injector

Yara detected MassLogger RAT

Yara detected MSIL Logger

Yara detected Powershell decode and execute

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7u4ell5pvyvvj3exq3cpoina4p5v2cwsa6yowbkrqli7efz3rlnq._file

Threatray novastealer

Verdict:

malicious

Label(s):

novastealer

Alert

Create hunting rule

Similar samples:

2a55ad3e88306641e6aa9b88c840b384bafe103445c5c5f44cf1f4c1648c894f

MassLogger

360ca290783e8135d794a7e5952a7b5a964cfad8a202438468aad9512d76afc9

MassLogger

5981ad3b28c03107c09d9f076333ff11dcb9ac2625549ff70fe27d5741070170

MassLogger

b8ceae46f1e55b2cdcbb4a5681e4ec73dc2e3981b79cc7d4097a48e38a835467

MassLogger

d1bd52996d15f124682fc7c59f4a70d7b54f5a89919f8de36f09fe0efc51eb5c

MassLogger

error

MassLogger

fbb23eda9bc927cc72810831dde3e28ef4baffddc7f28ee016c1e6ccc133a275

MassLogger

+ 727 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution

Link:

https://tria.ge/reports/250327-s1kstatzbv/

Behaviour

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

System Location Discovery: System Language Discovery

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Looks up external IP address via web service

Blocklisted process makes network request

VMRay PrivateLogger

Malware family:

PrivateLogger

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/fd3845afafae/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fd3845afafae2b54ec9786c4f721a0e3fb5d0ad207b0eb055182d1f2173b8adb