MalShare

Recently added Samples

SHA256 Hash	File type	Added	Source	Yara Hits
9ef3a283ac6b0a7db3629ce93449f1cd47657f9ef1ede891975a67c5e08be6c8	PE32	2024-10-01 13:28:57 UTC	User Submission	YRP/MD5_Constants YRP/IP YRP/contentis_base64 [+] YRP/domain YRP/excel_XML YRP/gem YRP/pgml YRP/rip YRP/amf YRP/prc YRP/x3d YRP/_3dxml YRP/AutoIT_compiled_script YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/inject_thread YRP/network_http YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/Armadillo_v2xx_CopyMem_II_additional YRP/Microsoft_Visual_Cpp_70_MFC YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/AutoIt
568b91c6e63fc0e90ccaaec9755793a3b1febc7706c56bb60e83ae1c3e37e515	PE32+	2024-10-01 13:28:54 UTC	User Submission	YRP/Advapi_Hash_API YRP/CRC32_poly_Constant YRP/CRC32_table [+] YRP/maldoc_find_kernel32_base_method_1 YRP/ppaction YRP/IP YRP/contentis_base64 YRP/domain YRP/url YRP/excel_XML YRP/gem YRP/pgml YRP/wmf YRP/amf YRP/prc YRP/xaml YRP/x3d YRP/_3dxml YRP/Misc_Suspicious_Strings YRP/DebuggerException__SetConsoleCtrl YRP/anti_dbg YRP/antisb_threatExpert YRP/inject_thread YRP/create_service YRP/network_tcp_listen YRP/network_dropper YRP/network_tcp_socket YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Http_API YRP/Microsoft_Visual_Cpp_80_DLL YRP/NETexecutableMicrosoft YRP/IsPE64 YRP/IsConsole YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature
cf75aba9a67cca73eb0fd5eaf9ad9364b7891c09367ac163ed2317b25e02c419	PE32	2024-10-01 13:28:51 UTC	User Submission	YRP/maldoc_getEIP_method_1 YRP/domain YRP/Safeguard_103_Simonzh [+] YRP/ZProtect_v144_lifeengines YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasModified_DOS_Message FlorianRoth/Sality_Malware_Oct16
12dc13e5b343ecee61c7ff11aefcb1c894a324e859f163975314ce5aa98988d7	ASCII	2024-10-01 13:28:46 UTC	User Submission	YRP/contentis_base64 YRP/domain YRP/url
72975b31fbe4d4a037138e4aeba2426a7148dc73558c43d5eb42b90f4d64284b	PE32	2024-10-01 13:28:42 UTC	User Submission	YRP/CRC32_poly_Constant YRP/contentis_base64 YRP/domain [+] YRP/excel_2007 YRP/ai_compressed YRP/corel_draw_compressed YRP/odg YRP/rip YRP/_3dxml_compressed YRP/escalate_priv YRP/screenshot YRP/win_token YRP/win_files_operation YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Wise_Installer_Stub YRP/WiseInstallerStub YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/HasRichSignature
338f9ef05a09dcb38a235806ee33c642719f7ad0a0a8a0333ae48752ea32c9e7	PE32	2024-10-01 13:28:39 UTC	User Submission	YRP/Big_Numbers1 YRP/MD5_Constants YRP/VC8_Random [+] YRP/IP YRP/contentis_base64 YRP/domain YRP/url YRP/gem YRP/prc YRP/Browsers YRP/Dropper_Strings YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Wininet_Library YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Armadillo_v4x YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature
c5293e0c508b5dde366f8d0de733958e11629bca92b09e3e68bc860de86d84a3	PE32	2024-10-01 13:28:36 UTC	User Submission	YRP/maldoc_getEIP_method_1 YRP/contentis_base64 YRP/domain [+] YRP/suspicious_packer_section YRP/NsPack_29_North_Star YRP/nSpack_V2x_LiuXingPing YRP/nSpack_V2x_LiuXingPing_additional YRP/nSpack_V29_LiuXingPing YRP/nSPack_1x2x_North_StarLiu_Xing_Ping YRP/nSpackV2xLiuXingPing YRP/NsPack29NorthStar YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay
bba27232c302eb8f456621825f58a63f6967d5f741b9013dc07ecf15b00fd929	PE32	2024-10-01 13:28:33 UTC	User Submission	YRP/domain YRP/suspicious_packer_section YRP/UPX [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/HasRichSignature FlorianRoth/DragonFly_APT_Sep17_3
b0e73a4c068afa8b4445e3659c70f35d7ec6497aeb95d907e258ba802bf07a74	PE32	2024-10-01 13:28:26 UTC	User Submission	YRP/IP YRP/contentis_base64 YRP/domain [+] YRP/ai_compressed YRP/prc YRP/Misc_Suspicious_Strings YRP/network_http YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/suspicious_packer_section YRP/Microsoft_Visual_Basic_v50 YRP/VMProtect_1704_phpbb3 YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature
76dc6170e0899b1e9f443efbc47a6aee25b0e4422ecf69c911531fc38bde51f8	PE32	2024-10-01 13:28:18 UTC	User Submission	YRP/maldoc_find_kernel32_base_method_1 YRP/contentis_base64 YRP/domain [+] YRP/DebuggerException__SetConsoleCtrl YRP/escalate_priv YRP/win_token YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/Borland_Cpp_DLL YRP/Borland_Cpp_for_Win32_1999 YRP/Borland YRP/IsPE32 YRP/IsDLL YRP/IsWindowsGUI YRP/HasOverlay