MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00783e694623ab5bf6310d51a830403ee5946085869f4f0cbd6d48fcbec426b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	00783e694623ab5bf6310d51a830403ee5946085869f4f0cbd6d48fcbec426b3
SHA3-384 hash:	b68dc860a2a997a46676a229fad418725a3a20d936623cfa3bceae485908350037228672eb2246977455db23ff64ed9a
SHA1 hash:	81c5893e6723421614ee39a41d1349d980b67f11
MD5 hash:	f3e479ec5bc796a1055c869ba0de779e
humanhash:	robert-louisiana-solar-minnesota
File name:	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_042025.pdf.img
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	1'052'672 bytes
First seen:	2025-02-04 16:16:43 UTC
Last seen:	2025-02-04 16:49:27 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	24576:+8SZnWMvyCyCPg81+jRLFL4w+1Ow4t1gmpPVn:SnW2yCyCPl+jk1izp9n
TLSH	T13225DFD03729AB17DE7596B08621DCB443B528687060F5D62ECD37DBB6E9B209E08F07
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	cocaman
Tags:	AgentTesla img payment

cocaman

Malicious email (T1566.001)
From: "Finance Manager <omar.al-mansoori@alraedtrading.com>" (likely spoofed)
Received: "from [45.83.31.94] (unknown [45.83.31.94]) "
Date: "4 Feb 2025 17:48:13 +0100"
Subject: "=?UTF-8?B?RldEOiBQYXltZW50IENvbmZpcm1hdGlvbiDigJMgU1dJRlQgVHJhbnNhY3Rpb24gI01UMTAzODUyNTg0OQ==?="
Attachment: "CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_042025.pdf.img"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	CONFIDENTIAL_PAYMENT_CONFIRMATION_TRANSACTION_DETAILS_042025.pdf.exe
File size:	991'232 bytes
SHA256 hash:	2d5f57ef41272fafdd56ac619de62e86bf57938c96032cfa90eaa3c48930f012
MD5 hash:	ff1343c3af2239cb059bb9bed403c15f
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_badexts64.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a23ef951193558eb195e52

Tags:

virus micro msil

Gathering data

Verdict:

Suspicious

Labled as:

Mal/DrodIso

Link:

https://www.hybrid-analysis.com/sample/00783e694623ab5bf6310d51a830403ee5946085869f4f0cbd6d48fcbec426b3

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00783e694623ab5bf6310d51a830403ee5946085869f4f0cbd6d48fcbec426b3/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2025-02-04 16:16:46 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

13 of 23 (56.52%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ab4d42kgeovvx5rrbvi2qmcah3sziyefq2pu6df5nvepzpwee2zq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/00783e694623ab5bf6310d51a830403ee5946085869f4f0cbd6d48fcbec426b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)