MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf
SHA3-384 hash: 62b807d43c4b54547c9d749b82df083d93ec51868b93280f53300bf1dfa8f14549f51780d6f5fab4d1e784c4e025a9b1
SHA1 hash: ccbcdbc30ff6dc8bccf02293e64dd0c6f7ed6870
MD5 hash: b4268b7d10e74fcd07a5dc96aa21e7c6
humanhash: lamp-william-oven-crazy
File name:quotation5.zip
Download: download sample
File size:1'623'613 bytes
First seen:2021-03-30 06:27:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:xDoi9fqgVsDPllXlFQFsseHzs8DkESaO4BQRfVQ:6OfglrbskwEmb9Q
TLSH 2C7533AF4007352C4484FEF14146AE256E96682ECBDAEDD377F002EB4D468A5B72F1C6
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: slot0.eerient.com
Sending IP: 203.159.80.109
From: pmc@pharmachine.com
Attachment: quotation5.zip (contains "quotation5.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Siggen6.55368.10879.8316.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf/
Threat name:
Win32.Trojan.Spynoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-29 22:40:01 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ceqmseqszgj5j353mhki6rhpgaul4ne2yt2tjfhsuanx63pcfo7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf

(this sample)

Executable exe 609aa18f8033b266001d86ce69104f81ce0d520df8e1718277bdf2479acb11e8

  
Dropping
MD5 91e462491bc750e8f64c92a91afb88ce
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 609aa18f8033b266001d86ce69104f81ce0d520df8e1718277bdf2479acb11e8

Comments