MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc
SHA3-384 hash: 7a88784d9ae315e2570fb32e28310027585893d4165969332300d3684ae4f8bdabf31bb6ca4e696b01667289ccd2df04
SHA1 hash: 709e2e939de37dd2e39144f683c8e4b6d35e62e0
MD5 hash: b47155ebe2054d083a582e92e4cfbdcb
humanhash: fillet-football-hawaii-missouri
File name:1003b.exe
Download: download sample
File size:484'352 bytes
First seen:2021-05-07 04:44:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 34b5ed9627adc2a136538773f5ab1f74
ssdeep 12288:odj/1ccA+gu6d2c+G+QZGo/pai4Z+fL6aZHa7:o9tfY6ShUK2c
Threatray 31 similar samples on MalwareBazaar
TLSH E8A4AE03A498CD46F1B79B74C64585F657BF5FC1D8C2822762287F0FBA716A8C68B381
Reporter starsSk87264403

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
b47155ebe2054d083a582e92e4cfbdcb.exe
Verdict:
Suspicious activity
Analysis date:
2019-04-28 08:39:22 UTC
Tags:
loader
Link:
https://app.any.run/tasks/1a36cf98-21c8-469f-9dc3-091a42450e47

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/152381/
Detection(s):
PUA.Win.Packer.Mpress-7
Create hunting rule

SecuriteInfo.com.Pakes3_c.QAV.29716.3986.24181.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
DNS request
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/715724
Signature
Detected unpacking (changes PE section rights)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2016-08-27 03:44:04 UTC
AV detection:
21 of 47 (44.68%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1b09e1ef7e44680e2fdd5909dbae73c46ad9d4d007f9ef077acfa102a613f908
6038e37ba1da37980c6d1436a98e4793843e153511b8e54f8411b428d3e31ef1
64dc4778b395fe6ba6b4911bb39d41dc2a1d5cb0655c0f369b25b5e38f0e27ec
6de9fe7d510845139ac7228f137e50d6caa771be883b1a1b5f2244ab04ca5b79
a735f487179cdb2e5fb6a366750e12c774d485a6259cbdc8c0aa6f726b1992f7
bec4fa4086e8913a708a4bacb710b4f88f82082a2d282641b24af1f31e6652b9
e33a23357c21735f7c2c471aeecedbd7daf9c3cdf2908104bca26f14eef592a3
e7662182c984884cdf7c0c436538bc82cb1d8f91c2d6bfe0cec1ba9b3d63c259
ed4aef67444c1b22bd8ef038a1544fbcc65b602111020db1a5a2a88e1964e4f1
fd7ee166a2ef80d3dc9668383540eade22f9cf7125a870bd0efb0f14b1239e31
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210507-gabx4h3bks/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Program crash
Downloads MZ/PE file
Unpacked files
SH256 hash:
62bfdc65b3838797b8ca733a5403fdce30f102ac9f5c8fdfdf44e2361a19eea3
MD5 hash:
40540dd13258c7d060500f8f51906e20
SHA1 hash:
9b8ccba79c3bea014abb752f07257137fe112364
Link:
https://www.unpac.me/results/798036c8-991f-46a3-8a7b-8cd7f8cc96e9/
SH256 hash:
fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc
MD5 hash:
b47155ebe2054d083a582e92e4cfbdcb
SHA1 hash:
709e2e939de37dd2e39144f683c8e4b6d35e62e0
Link:
https://www.unpac.me/results/798036c8-991f-46a3-8a7b-8cd7f8cc96e9/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Sality
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_MPress
Create hunting rule
Author:ditekSHen
Description:Detects executables built or packed with MPress PE compressor
Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe fee54efb01bab4e542a5ba366f53eaf6d4494bdf3b0051384569b2235ac164cc

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/152381/
  
URLhaus
https://urlhaus.abuse.ch/url/186282/
  
Delivery method
Distributed via web download

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-07 05:18:10 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [F0001] Anti-Behavioral Analysis::Software Packing