MalShare

SHA256 Hash	File type	Added	Source	Yara Hits
c3fca5429e05260147b7233465a16e49a18094dc5006ec93b859c8eba8a448e0	PE32	2022-03-12 02:40:39	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
806a2e29a459fbc282f4fa0ddd44344e166aca2cb63f840d4d597df5d9c57fb9	PE32	2022-03-09 02:08:58	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/suspicious_packer_section
6fa3cd2a3368cc0bec110545d4b93141528b32d349029d7f1d6a85fa1a765f6a	PE32	2022-03-08 02:03:16	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
d61f135d2da176c567552241c77e4ebf274a18a2e475d2b6e8d1d3048ce1f623	PE32	2022-03-07 02:00:29	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
0281a3df4c3626c144d04210e776a0f6078244e64eb0713c468bca08d09b7e5d	PE32	2022-03-05 02:12:54	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
915657a1cdec26809fd313c591bdb5841424080bd33c07197e251bf8a40e19a9	PE32	2022-03-01 22:02:26	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Big_Numbers0 YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/suspicious_packer_section
a94a270991241875a66c3106a3d76007db59b3109cd9d8a23b4e68d46aa4565f	PE32	2022-02-28 20:00:29	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/with_images YRP/without_attachments YRP/with_urls YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/disable_antivirus YRP/create_service YRP/network_http YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/DES_sbox YRP/RijnDael_AES YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
90c51466f7d5dc9a9ef6ab7aea573ebfd8381a5f4ad6e4ba8ea91f7df58c7e4a	PE32	2022-02-28 02:02:06	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Big_Numbers0 YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/suspicious_packer_section
c4b6150db39e932308e4c1ddfee987a087e9963606096e5186893a0c6b0589ad	PE32	2022-02-26 21:00:19	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/RijnDael_AES
2c7836fc2c997a43a14476f1edff04f5dd173b352c8b3816c1fd6deaecf36ad7	PE32	2022-02-24 04:16:22	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/with_images YRP/without_attachments YRP/with_urls YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/disable_antivirus YRP/create_service YRP/network_http YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/DES_sbox YRP/RijnDael_AES YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
8b7d5d8d1750c7b358d352c1f438a1084525cc6922bb0b7a2fce5a8861d09c35	PE32	2022-02-23 02:49:47	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
9cbe8a661e35a16f533b61ece8bbb5889d0430ad660c47a899dc44fc288f0277	PE32	2022-02-22 04:35:28	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/HasOverlay YRP/HasRichSignature YRP/with_images YRP/without_attachments YRP/with_urls YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/System_Tools YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/WMI_strings YRP/Misc_Suspicious_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/disable_antivirus YRP/create_service YRP/network_http YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/rat_rdp YRP/rat_webcam YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/DES_sbox YRP/RijnDael_AES YRP/BASE64_table YRP/VC8_Random YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/GenerateTLSClientHelloPacket_Test
eb141c85532380ae6674e0814c07ce2b5b614df4814f6b4ece5baadc353ad69e	PE32	2022-02-19 02:53:30	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
4a318cd64eabe1a07b2f842dd527498696a2099f2941e653494dcf3d284a4d52	PE32	2022-02-18 01:58:03	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/escalate_priv YRP/screenshot YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES
bef7308c09ff60751232d08f839ac3840e048aeb383147aa710d6b47d5f8e089	PE32	2022-02-16 19:32:07	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/suspicious_packer_section
197e3f2fa9b9e14b701b6cddabe4c23dc12bc1c3c1345d2dd06ab8ba8cdc8678	PE32	2022-02-16 14:47:24	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
9a03af49df6fd2f1e0946aa96a98bba18764d516a39b7731fd654e65572e6bd9	PE32	2022-02-14 07:00:56	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
5dcb6543f39e2f605cb59d25aeb6a7a550cd2588959dac386d4328540e2b3e6c	PE32+	2022-02-13 02:24:42	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/network_dns YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
734109e79081dfba249edcff75cb1653a16644f498d24e947a5f3aeb9c46692b	PE32	2022-02-13 02:03:37	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
e52c0fb7aa261a12ec419c18e06a55dac744feda85aef906cac81d42900d82bd	PE32	2022-02-12 02:06:45	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_dga YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
7be0229638d5b7c4c5394e63d455ca4bc22130f1c6f9eca7b302d7941ae6fc75	PE32+	2022-01-12 02:10:30	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/network_dns YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
494398d3d77bf0ed0e4178ae172347b86b0c16501fe6e22bcff33854beab0231	PE32+	2022-01-12 02:02:42	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/network_dns YRP/win_registry YRP/win_files_operation YRP/android_meterpreter YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
c8cd324d2d5e55ddddafe69d59ec749e6560428258aa9593079ef9c3d42549ad	PE32+	2022-01-12 02:00:45	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/network_dns YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
5ec66d9738e9a52f8a9cc7adb4435d17527c600a45ad47fb5116109ec6efee47	PE32	2021-12-16 03:14:06	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_mutex YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Http_API YRP/suspicious_packer_section
18a5c872854f70b391af0696978bfb35d8ae08059971dd9eb8219f5aef40c026	PE32	2021-12-08 02:14:04	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/RijnDael_AES
f224eb6d7d25fed68f1053c7f38fbf09e416fc55230d04a1591e97aa2144c092	PE32	2021-12-07 12:04:07	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/RijnDael_AES
080ae7428afb432b6ad93881f0f043dc680e6299f7f1c1f1a6d6fd5a8f6db8b3	PE32+	2021-12-03 02:30:10	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/network_dns YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library
7c28b994aeb3a85e37225cc20bae2232f97e23f115c2a409da31f353140c631e	PE32	2021-11-29 00:07:21	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/inject_thread YRP/network_http YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
887aae4c40ef5ac852dcb98c50598ae087e21ba02456b35da67365fcfa6fea9b	PE32	2021-08-31 11:03:43	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsNET_EXE YRP/IsWindowsGUI YRP/IsPacked YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/RijnDael_AES
fe98c84e397515f84672acdae1147eef8adb1c11ffae1e438deadaff16fd9a2f	PE32+	2021-07-30 12:01:39	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/DebuggerException__SetConsoleCtrl YRP/ThreadControl__Context YRP/SEH__vectored YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES
95469ab7bcbc64c662be3cf631efead7c2dcaa527ed68d98a7df16e125091311	PE32+	2021-07-23 11:01:39	User Submission	YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE64 YRP/IsWindowsGUI [+] YRP/IsPacked YRP/HasOverlay YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/anti_dbg YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES YRP/spyeye
742311a208d4efa87171752ffad642d940c00d2b0767e00d1f722d13a8786dc1	PE32	2021-03-02 09:49:44	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsDLL YRP/IsConsole YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES
195a274fc404da902569f0f6ff707e429f8e510b098d8cd8bde6b5b89a91b228	PE32	2021-02-28 01:20:15	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsDLL YRP/IsConsole YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES
92714bd064db14df090e83922023d6ebc0e515909e223e9277a35c570b0a36e0	PE32	2020-07-08 19:31:32	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/inject_thread YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
1c6c9635f0c01cc93b504293351215058cf9ef8b62ca38ce71012a4875fbe0a4	PE32	2020-07-08 09:53:37	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsNET_EXE YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES
1195d7472ed26af12531966f6b4c7f0acba4860de7582bb634c6615c47584752	PE32	2020-06-29 11:01:31	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/inject_thread YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES
113a7a999c545e6d73900ad870fd531bc7682a416e555e3f9b5cc2087f446040	PE32	2020-06-27 08:24:42	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/SEH__vba YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES
968d8fdfd8e4658fdedb91ad1f12b70078ac0813390c8d2775ee6459c94f5c25	PE32	2018-09-24 13:40:53	http://dianxin8.52zsoft.com/douzhanshenfuzhu....	CuckooSandbox/vmdetect YRP/possible_includes_base64_packed_functions YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 [+] YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_http YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
1223cc4330b517a15261c93edd21bd1f0fa05df53c919ee0ff0aeee452ef823d	PE32	2018-09-24 00:59:09	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/IsBeyondImageSize YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/win_registry YRP/win_files_operation YRP/MD5_Constants YRP/RijnDael_AES
b7067b67a9bcd076f2e75391d390e14f889c61ee06ecd9df97c6f5cae788cb0d	PE32	2018-09-23 12:49:31	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/network_http YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API
f0681605b39a28be2d8e205fbe428ca4b4f5b7f33164bb2c14b3168287f5699e	PE32	2018-09-21 12:48:54	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsWindowsGUI YRP/IsPacked YRP/HasRichSignature YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/contentis_base64 YRP/VM_Generic_Detection YRP/VirtualPC_Detection YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/antivm_bios YRP/screenshot YRP/keylogger YRP/win_registry YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/android_meterpreter YRP/Big_Numbers1 YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Winsock2_Library YRP/suspicious_packer_section
9e183a1f80df78a13e02e4bf1d4cad869bee239ef6e9187a9d1ff171c485eacb	PE32	2018-09-05 09:01:41	User Submission	CuckooSandbox/vmdetect YRP/possible_includes_base64_packed_functions YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 [+] YRP/UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser YRP/IsPE32 YRP/IsWindowsGUI YRP/IsPacked YRP/HasOverlay YRP/HasDigitalSignature YRP/with_images YRP/without_attachments YRP/with_urls YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/inject_thread YRP/create_service YRP/network_udp_sock YRP/network_tcp_listen YRP/network_http YRP/network_dropper YRP/network_tcp_socket YRP/network_dns YRP/escalate_priv YRP/screenshot YRP/keylogger YRP/sniff_audio YRP/win_mutex YRP/win_registry YRP/win_token YRP/win_private_profile YRP/win_files_operation YRP/win_hook YRP/Big_Numbers0 YRP/Big_Numbers1 YRP/CRC32_poly_Constant YRP/CRC32_table YRP/MD5_Constants YRP/RIPEMD160_Constants YRP/SHA1_Constants YRP/DES_sbox YRP/RijnDael_AES YRP/BASE64_table YRP/Str_Win32_Winsock2_Library YRP/Str_Win32_Wininet_Library YRP/Str_Win32_Internet_API YRP/Str_Win32_Http_API YRP/UPX YRP/suspicious_packer_section
dd4541908a6662418b076233e53d00afc8d13c648140651fd8cb51d00ddeffc1	PE32	2018-06-23 03:20:57	User Submission	CuckooSandbox/vmdetect YRP/Safeguard_103_Simonzh YRP/Safengine_Shielden_v2160 YRP/IsPE32 [+] YRP/IsNET_EXE YRP/IsWindowsGUI YRP/IsPacked YRP/HasDebugData YRP/maldoc_find_kernel32_base_method_1 YRP/maldoc_getEIP_method_1 YRP/domain YRP/IP YRP/url YRP/contentis_base64 YRP/VirtualPC_Detection YRP/Dropper_Strings YRP/DebuggerCheck__RemoteAPI YRP/DebuggerHiding__Thread YRP/ThreadControl__Context YRP/vmdetect YRP/anti_dbg YRP/keylogger YRP/cred_local YRP/win_registry YRP/win_files_operation YRP/win_hook YRP/Advapi_Hash_API YRP/MD5_Constants YRP/RijnDael_AES YRP/Str_Win32_Wininet_Library YRP/CAP_HookExKeylogger

Recent Searches
yrp/safengine_shielden_v2160
yrp/keyboy_errors
yrp/win7elevatev2
yrp/_v10_li_jianjun
yrp/implant_2_v3
yrp/upackv032betapatchdwing
yrp/byshell063_ntboot_2
yrp/pe_pack_v10_by_anakin_1998_
yrp/webshell_php_404
yrp/webshell_dc3_security_crew_shell_priv

Search

Recent Searches