MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkTortilla

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277
SHA3-384 hash:	ebe7a7273a8eefb56af3811f518daf57f72c07f89d19463009c62611500f5ffeb69e73e87ef5e67f639c7685ff7e032f
SHA1 hash:	e23d0c1e7e7b3c96cc17257680f9f1d08057be52
MD5 hash:	08747e40a4694d8d11863b93f79ad841
humanhash:	echo-failed-winner-quiet
File name:	PO#01072025_(800kb)pdf.arj
Download:	download sample
Signature	DarkTortilla Create hunting rule
File size:	503'616 bytes
First seen:	2025-07-02 11:29:18 UTC
Last seen:	2025-07-02 11:33:23 UTC
File type:	arj
MIME type:	application/x-rar
ssdeep	12288:UIkXejRpPg1L2WMawCK938NSj7BXnV0gZnbUwCr+cmwj+c8fn3+:Un25OtyCwRj7lnV0gZngwW+cmC+Rnu
TLSH	T1D4B42311871F3F834952AC0424F1778F91FADE187D5B4A2BB8A95157F06BBE04B839E2
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	arj DarkTortilla RFQ

cocaman

Malicious email (T1566.001)
From: "KORKMAZ <urs.lustenberger@lgpartner.ch>" (likely spoofed)
Received: "from [196.251.71.142] (unknown [196.251.71.142]) "
Date: "2 Jul 2025 02:24:29 -0700"
Subject: "RFQ 2025"
Attachment: "PO#01072025_(800kb)pdf.arj"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	PO#01072025_(800KB)pdf.exe
File size:	822'784 bytes
SHA256 hash:	eb1a02ec53eba0ce4ae75d74d6dff37d4e920390d8bd4f6e525761cb52208a22
MD5 hash:	8d44f00f6a87e0bc15b5f244e3eda0c2
MIME type:	application/x-dosexec
Signature	DarkTortilla

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686491bb900df8e7f8654b92

Tags:

dropper micro

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 findstr fingerprint lolbin obfuscated obfuscated phishing reconnaissance vbnet

Link:

https://www.filescan.io/uploads/686518457423ff017c3bf801/reports/5e1321ff-f9d1-4dbf-8279-ea8e3d14a014/overview

Verdict:

Malicious

Labled as:

Malware.Generic

Link:

https://www.hybrid-analysis.com/sample/183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277/

Verdict:

Malicious

Threat:

Win32.Trojan.Zmutzy

Link:

https://tip.neiki.dev/file/183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2025-07-02 00:15:06 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=da5epzv4fjweb5bjzpampk37qqn5m7kbytjplzcuvfme7dvwcj3q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/183a47e6bc2a6c40f429cbc0c7ab7f841bd67d41c4d2f5e454a9584f8eb61277

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)