MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0de64ee9ffa0fcaa48c4c46c8436b3bd91583311decc3b33df9360b4344b674b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0de64ee9ffa0fcaa48c4c46c8436b3bd91583311decc3b33df9360b4344b674b
SHA3-384 hash: 7e75549bf1ff75f5eba169c746ca740213920944a90f399da5f17c75823e18373869f9513363f0f520c7ce190f50c75f
SHA1 hash: 57ab41c32334d14e2a0d63d9717671bd38330888
MD5 hash: a925bb040af26ff07f0da54e5bb7de78
humanhash: finch-neptune-washington-snake
File name:INVOICE_PRF.pdf.arj
Download: download sample
File size:473'809 bytes
First seen:2021-02-26 13:52:33 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:YCv8S2N2Bo7AvdApRXHSdIa/uavTzD338VlxxZ53l9IIYUv4npwYTil:YCv/FBlifkIa/+Vbv5bwbOl
TLSH AFA42347E649B424F1FE5544B7D437AECF9B110ECA2B52E770AAC8F0DA19D007B8668C
Reporter GovCERT_CH

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fn25.UNOFFICIAL
Create hunting rule

PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Sanesecurity.Malware.21146.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0de64ee9ffa0fcaa48c4c46c8436b3bd91583311decc3b33df9360b4344b674b/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 13:53:05 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bxte52p7ud6kusgeyrwiinvtxwivqmyr33gdwm67snqlinclm5fq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 0de64ee9ffa0fcaa48c4c46c8436b3bd91583311decc3b33df9360b4344b674b

(this sample)

Executable exe a6b9e71775ba3672a587c1054ee2e9670967809b0c5183f798ba24b4fd018e3c

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6b9e71775ba3672a587c1054ee2e9670967809b0c5183f798ba24b4fd018e3c
  
Dropping
MD5 66a6c81bf89897ad7d7171a9e756ce65

Comments