MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45b26d2085ede250de311b3aa2ba7fc42ae091546f587ca439b52e366d744e63. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45b26d2085ede250de311b3aa2ba7fc42ae091546f587ca439b52e366d744e63
SHA3-384 hash: 8f16c016fb2e08f1fafba2a3696ea9b02e6ac925e603b78faecb19b9f6cfb0c18615de395b8bfc0fa6a17b40b6672b7a
SHA1 hash: 5a0cb02dd07361276444cc9898c98fc39b98e787
MD5 hash: aabae6e2ae1c784be197bd9e2ff742e1
humanhash: hydrogen-july-timing-nuts
File name:Order 488756.zip
Download: download sample
File size:1'029'045 bytes
First seen:2020-08-16 08:05:48 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:qntOw3f76fBV958yQ11SnEGhJVSTqOqua28rSulzYwfj:etOwP76D9mynEGhTXOquaRplzRb
TLSH 812533F1EA484A6721D6FA0DFAE48537023578F9C98C911EAF5682BCB654DC374D4EC0
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vm4228.cloud.seeweb.it
Sending IP: 85.94.210.165
From: rafaeljorgefernandes@gmail.com
Subject: weekly order confiration
Attachment: Order 488756.zip (contains "Order 488756.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.23990.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45b26d2085ede250de311b3aa2ba7fc42ae091546f587ca439b52e366d744e63/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-16 08:07:06 UTC
AV detection:
27 of 48 (56.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iwzg2ief5xrfbxrrdm5kfot7yqvobekun5mhzjbzwuxdm3lujzrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.48
Link:
https://yomi.yoroi.company/submissions/45b26d2085ede250de311b3aa2ba7fc42ae091546f587ca439b52e366d744e63

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 45b26d2085ede250de311b3aa2ba7fc42ae091546f587ca439b52e366d744e63

(this sample)

Executable exe f6fb0f9050f39e6c6b3441d6a71d0e975552093fcf77f1d45ab06ef9b1fd7691

  
Dropping
MD5 a203977a3bdd9ba9a22a56952cc4969a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f6fb0f9050f39e6c6b3441d6a71d0e975552093fcf77f1d45ab06ef9b1fd7691

Comments