MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5d5a39f1157946e157c7b24c8a7ad0337ca9383389bce98a83a346bae442445. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

@abuse_ch

Malspam distributing unidentified malware:

HELO: secure.zrl.com.zm
Sending IP: 216.194.164.118
From: Account Finance<accounts@victim-domain>
Subject: Payment Advice For your reference
Attachment: Payment_pdf.zip (contains "Payment_pdf.cmd")

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

65

Origin country :

FR

Mail intelligence

Geo location:

Global

Volume:

Low

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_pdf.UNOFFICIAL

Alert

Create hunting rule

Porcupine.Malware.43883.UNOFFICIAL

Alert

Create hunting rule

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a5d5a39f1157946e157c7b24c8a7ad0337ca9383389bce98a83a346bae442445

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/a5d5a39f1157946e157c7b24c8a7ad0337ca9383389bce98a83a346bae442445/

ReversingLabs TitaniumCloud ByteCode-MSIL.Downloader.BaseLoader

Threat name:

ByteCode-MSIL.Downloader.BaseLoader

Alert

Create hunting rule

Status:

Malicious

First seen:

2021-02-23 07:21:10 UTC

AV detection:

9 of 47 (19.15%)

Threat level

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://www.spamhaus.org/query/hash/uxk2hhyrk6kg4fl4pmsmrj5nam34ve4dhcn45gfihi2gxlseercq._file

VirusTotal 18.46%

AV coverage:

18.46%

AV detections:

12 / 65

Link:

https://www.virustotal.com/gui/file/a5d5a39f1157946e157c7b24c8a7ad0337ca9383389bce98a83a346bae442445/detection/f-a5d5a39f1157946e157c7b24c8a7ad0337ca9383389bce98a83a346bae442445-1614061700

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00