MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | 0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52 |
|---|---|
| SHA3-384 hash: | 579768ce25d8c48ae788696e6823662793a464848bc6173f5aff1be58d9d2aef53797e99101be3170b0e4270ad655f85 |
| SHA1 hash: | 813421b2012b0a7c0e436dff22334b1d2c286d8e |
| MD5 hash: | 33ea75b804fa5b36e6d7efd2742aff03 |
| humanhash: | carpet-hawaii-berlin-louisiana |
| File name: | Quotation.exe |
| Download: | download sample |
| File size: | 1'125'376 bytes |
| First seen: | 2020-12-17 08:29:23 UTC |
| Last seen: | 2020-12-17 08:35:48 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'749 x AgentTesla, 19'653 x Formbook, 12'246 x SnakeKeylogger) |
| ssdeep | 12288:o8zm3QQyCWslmy/jT+D9sE4hTj8Zweo3+59//qE7HSR6N2WCHmmU0klQzQjY9PI:o8zA66fhv8Zweo3+59CE7yRg2BUXj2 |
| Threatray | 7 similar samples on MalwareBazaar |
| TLSH | 3B358D2436E95719F137EBB956D0754587FEFE23A31AD45A3C9122CB0632F00CE91A3A |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: abcdpins.com
Sending IP: 45.35.101.8
From: sale02@abcdpins.com
Subject: RE: End Of Quater Perviously Sent quotation PO0118-12/20 Batch0271231 2020
Attachment: Quotation2.7z (contains "Quotation.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation.exe
Verdict:
Suspicious activity
Analysis date:
2020-12-17 08:29:54 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Launching a process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
64 / 100
Signature
.NET source code contains potential unpacker
.NET source code contains very large strings
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Status:
Malicious
First seen:
2020-12-17 02:47:38 UTC
File Type:
PE (.Net Exe)
Extracted files:
33
AV detection:
23 of 29 (79.31%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Unpacked files
SH256 hash:
0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52
MD5 hash:
33ea75b804fa5b36e6d7efd2742aff03
SHA1 hash:
813421b2012b0a7c0e436dff22334b1d2c286d8e
SH256 hash:
ad5616e638fd76f42381042e9aa2835709b5e385fff6d07deb085515b799b95d
MD5 hash:
c3949c358ca512a930af0b40ada048d6
SHA1 hash:
403046c4e7b09efc57f621a9e4ac0f5078f39361
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.