MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1 |
|---|---|
| SHA3-384 hash: | 753b88224af322fead6849ec9e175350091d23d1fce9a3af76b02e5e5486c1f185a906352aa05e3957cd4f82a85666b1 |
| SHA1 hash: | c0a94c00c0dc10d077596afdaedebb0bcdf7436a |
| MD5 hash: | 1b9e5b3ce524614941d69bfc00db57b5 |
| humanhash: | maine-west-sodium-one |
| File name: | IATA.scr |
| Download: | download sample |
| File size: | 631'924 bytes |
| First seen: | 2020-05-21 07:38:26 UTC |
| Last seen: | 2020-05-21 08:53:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | ae9f6a32bb8b03dce37903edbc855ba1 (28 x CryptOne, 18 x RedLineStealer, 15 x njrat) |
| ssdeep | 12288:goQ7Xar2BHs/EIzm/ODafoIVu8AtaeKGgUP3ZoGae0NfQbohb7h0pvrtniT7Q:gZ7Xar2VsBq/OWfoIwNtaeKGgZGabNfq |
| Threatray | 9 similar samples on MalwareBazaar |
| TLSH | 11D40131BBC148B1D9B219345EF997711A3DBD311F348B5FA3A03A2D6E714C0A629B63 |
| Reporter |  abuse_ch |
| Tags: | scr |
abuse_ch
Malspam distributing unidentified malware:HELO: mail.dom-express.ru
Sending IP: 87.103.212.119
From: S7 Airlines <supp@s7.ru>
Subject: новый валидатор IATA во вложении
Attachment: IATA.zip (contains "IATA.scr")
Intelligence
File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Hesv
Status:
Malicious
First seen:
2020-05-21 08:36:13 UTC
AV detection:
20 of 30 (66.67%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
8/10
Tags:
upx
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 118dd258630c48b0beacd8b4c04c9c9cd3b9f698b660b6a904b1dfc033e00cd1
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.