MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4e1594739c54177f06e5fe0db652522258392dc4c5eb6b249cb321ca7e4c244. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4e1594739c54177f06e5fe0db652522258392dc4c5eb6b249cb321ca7e4c244
SHA3-384 hash: 6cceb1c24dd029e04018aa56bc6c68d968f522959fdc536e0a7510c6fec8551c0a78df4a3edb7ebea8bfdf25197eed23
SHA1 hash: a2e150efdd2bfc1d46236cf78791846628ff9a02
MD5 hash: b9779b492c4ead855473bd5ab029a216
humanhash: maine-neptune-zebra-jersey
File name:Shipping Details _PDF.rar
Download: download sample
File size:478'108 bytes
First seen:2020-07-31 12:16:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:CyaMNW93mCwbEKvI1UUQu31GwXPTFD8lBkmTzNV8sLhWlvgogtI:CyaM83QvI1V31dXPTFwlBkmdmsMl9
TLSH CBA423203401B075FDEFD9408DD98094D2826D972A885BD25DCD1CABCCAEF747A9B3DA
Reporter abuse_ch
Tags:rar TNT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: d0.006.viliianesefmsrl.cf
Sending IP: 139.59.208.231
From: "TNT EXPRESS CONSIGNMENT"<service@tnt.com>
Subject: TNT Express Delivery Consignment Notification
Attachment: Shipping Details _PDF.rar (contains "Shipping Details _PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27271.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4e1594739c54177f06e5fe0db652522258392dc4c5eb6b249cb321ca7e4c244/
Threat name:
ByteCode-MSIL.Trojan.Ymacco
Create hunting rule
Status:
Malicious
First seen:
2020-07-31 12:18:07 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtqvsrzzyvaxp4dol7qnwzjfeisyhew4jrplnmsjzmzbzj7eyjca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b4e1594739c54177f06e5fe0db652522258392dc4c5eb6b249cb321ca7e4c244

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar b4e1594739c54177f06e5fe0db652522258392dc4c5eb6b249cb321ca7e4c244

(this sample)

Executable exe d907d7da5552b08415af0136f83af0d42d9cfa4c4ebe827a3bcfe3ec4f09e76c

  
Dropping
MD5 80a7df3aa139f95f4d1300cbaa70527c
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d907d7da5552b08415af0136f83af0d42d9cfa4c4ebe827a3bcfe3ec4f09e76c

Comments