MalShare

Recently added Samples

SHA256 Hash	File type	Added	Source	Yara Hits
bd0a7c049cbee87dbfdc02ffdd25b96422a718127607869caee5ecdf04bc96f5	PE32	2024-10-08 13:01:26 UTC	User Submission	YRP/BASE64_table YRP/Delphi_FormShow YRP/Delphi_CompareCall [+] YRP/Delphi_Copy YRP/Delphi_StrToInt YRP/Delphi_DecodeDate YRP/IP YRP/contentis_base64 YRP/domain YRP/gif_animated YRP/excel_XML YRP/gif_bitmap YRP/gif89a_bitmap YRP/jpeg YRP/gem YRP/pgml YRP/amf YRP/prc YRP/x3d YRP/_3dxml YRP/network_udp_sock YRP/network_tcp_listen YRP/network_tcp_socket YRP/network_dns YRP/network_ssl YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Str_Win32_Winsock2_Library YRP/suspicious_packer_section YRP/CookieTools YRP/Borland YRP/IsPE32 YRP/IsWindowsGUI YRP/borland_delphi
aee754b4bf85adc892452df28dc94949637a8e7e32ca570efb2e046cc618654b	PE32	2024-10-08 13:01:21 UTC	User Submission	YRP/domain YRP/suspicious_packer_section YRP/UPX [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/HasRichSignature FlorianRoth/DragonFly_APT_Sep17_3
1ad2cc4ed0fab75edfeaaebb2d44d7266ce748f1ed8ce3266e87482e2577a8bd	PE32	2024-10-08 13:01:19 UTC	User Submission	YRP/contentis_base64 YRP/domain YRP/rip [+] YRP/wmf YRP/stl YRP/suspicious_packer_section YRP/Upack_036_beta_Dwing_additional YRP/Upack_V028_V0399_Dwing_20080321 YRP/Upack_028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing_h YRP/Upack_V03X_Dwing_additional YRP/yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h YRP/WinUpack_v039_final_relocated_image_base_By_Dwing_c2005_h2_additional YRP/WinUpack_v039_final_relocated_image_base_By_Dwing_c2005_h2 YRP/Upack_028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing YRP/Upack_v028_0399_relocated_image_base_Delphi_NET_DLL_or_something_else_img_srcimagessmiliessmilegif_ YRP/Upack_Patch_or_any_Version_Sign_by_hot_UNP YRP/Upack_Patch_or_any_Version_Dwing YRP/Upack_v028_039_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing YRP/Upack_v028_039_relocated_image_base_Delphi_NET_DLL_or_something_else_Dwing_h YRP/Upack_V03X_Dwing YRP/Upack_V036_V037_DLL_Dwing YRP/Upack_V028_V0399_Dwingnbsp_nbsp_SignByfly_20080321 YRP/Upack_036_beta_Dwing YRP/WinUpackv039finalrelocatedimagebaseByDwingc2005h2 YRP/Upack_PatchoranyVersionDwing YRP/UpackV037Dwing YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasModified_DOS_Message
fac6f8e9ed5038f7fe63570a23aad4e98d354c713f5993a1005334201c36f2e6	PE32	2024-10-08 13:01:16 UTC	User Submission	CuckooSandbox/vmdetect YRP/BASE64_table YRP/IP [+] YRP/contentis_base64 YRP/domain YRP/png YRP/gem YRP/rip YRP/prc YRP/Browsers YRP/Antivirus YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/Misc_Suspicious_Strings YRP/vmdetect YRP/Check_OutputDebugStringA_iat YRP/anti_dbg YRP/antivm_vmware YRP/network_dropper YRP/network_tcp_socket YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Typical_Malware_String_Transforms YRP/Armadillo_v171 YRP/Microsoft_Visual_Cpp_v60 YRP/Microsoft_Visual_Cpp_v50v60_MFC_additional YRP/Microsoft_Visual_Cpp_50 YRP/Microsoft_Visual_Cpp_v50v60_MFC YRP/Armadillo_v171_additional YRP/Armadillo_v4x YRP/Microsoft_Visual_Cpp YRP/IsPE32 YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature FlorianRoth/Typical_Malware_String_Transforms
be3f07eb329c9049a7647702ebe852b3d3414271cee3f86bded94669ccd16c31	PE32	2024-10-08 13:01:11 UTC	User Submission	YRP/IP YRP/contentis_base64 YRP/domain [+] YRP/excel_XML YRP/pgml YRP/amf YRP/x3d YRP/_3dxml YRP/win_registry YRP/suspicious_packer_section YRP/ASProtect_v123_RC1 YRP/ASProtect_v12x_New_Strain_additional YRP/Microsoft_Visual_Basic_v50 YRP/ASProtect_v12x_New_Strain YRP/ASProtect_v11_BRS YRP/ASProtect_V2X_Registered_Alexey_Solodovnikov YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov YRP/VMProtect_1704_phpbb3 YRP/ASProtect_v12_additional YRP/ASProtect_123_RC4_130824_Solodovnikov_Alexey YRP/ASProtect_133_21_Registered_Alexey_Solodovnikov_additional YRP/ASProtect13321RegisteredAlexeySolodovnikov YRP/ASProtectv12xNewStrain YRP/ASProtectv123RC1 YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature
7fc993f38ce7f35873c5162d4de40d749bf3caddea7406a94a34d2f84751ece4	PE32	2024-10-08 13:01:05 UTC	User Submission	YRP/contentis_base64 YRP/domain YRP/win_mutex [+] YRP/Armadillo_v4x YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature
43962a0191dfda67d7cfb6afd1a85d30847e543238c750e8674e8ddba325c31d	PE32	2024-10-08 13:01:02 UTC	User Submission	CuckooSandbox/vmdetect YRP/IP YRP/contentis_base64 [+] YRP/domain YRP/gem YRP/prc YRP/Obfuscated_Strings YRP/vmdetect YRP/anti_dbg YRP/win_files_operation YRP/VC8_Microsoft_Corporation YRP/Microsoft_Visual_Cpp_8 YRP/IsPE32 YRP/IsWindowsGUI YRP/HasRichSignature
75531345c79eb26634503d85777f1ad87ed46e9c02a475dfc3abde7515051391	PE32	2024-10-08 13:00:57 UTC	User Submission	YRP/domain YRP/Microsoft_Visual_Cpp_8_additional YRP/Microsoft_Visual_Cpp_8 [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/ImportTableIsBad
ecc9972c89ebdd3ec93d8e7308107b9471da4bc24e21ec46f607d7fa1adb9e3b	PDF	2024-10-08 13:00:53 UTC	User Submission	CuckooSandbox/vmdetect YRP/Big_Numbers1 YRP/invalid_trailer_structure [+] YRP/multiple_versions YRP/contentis_base64 YRP/domain YRP/url YRP/pdf YRP/jpeg YRP/VMWare_Detection YRP/vmdetect
63f904201edbc817f019fb8bc9d05f6a2945b84f8308c61e05a16543229d565c	GIF	2024-10-08 13:00:50 UTC	User Submission	YRP/webshell_Shell_ci_Biz_was_here_c100_v_xxx YRP/Webshell_c100 YRP/IP [+] YRP/contentis_base64 YRP/domain YRP/url YRP/gif_bitmap YRP/stl YRP/android_meterpreter