MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 18785530de0c06d99d817d29d0785470ae108d05f7bc2db218b00d2185ae50af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 18785530de0c06d99d817d29d0785470ae108d05f7bc2db218b00d2185ae50af |
|---|---|
| SHA3-384 hash: | aacb75fb77f103996096e836140a9864b79eab027810cd34d90ce4a5a65768940b092b1536c1af48bedeec3d37cdb7b7 |
| SHA1 hash: | c732b535bd2cce7efe9afe91afdcb9c24f36df5b |
| MD5 hash: | 7483e7f62152362866d2757c84b03ef7 |
| humanhash: | arizona-shade-twelve-friend |
| File name: | GD.zip |
| Download: | download sample |
| File size: | 12'658 bytes |
| First seen: | 2024-01-26 13:35:18 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| ssdeep | 192:b3yPPw2E+VK6DcK76xdQEiid4wwpN5s2Ls51bobX8AkMwqJTuvTg1WestZQy4qQg:8PwtK4QEiJpN5s2AobX8MwqJTPQV1kgl |
| TLSH | T19942B09C6BD6A1AFD46B322CD14AAA8D8E17181C3B9D83C787C73D1C9CCE429246B165 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  proxylife |
| Tags: | js SOFTWARE MEDICAL DEVICES LIMITED zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
301
Origin country :
IEFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Decrd.txt |
|---|---|
| File size: | 98'341 bytes |
| SHA256 hash: | ee85d1f8fa2c3d5c927bf3b547e8c4849e02185cc264a64d34ae8e896fc28616 |
| MD5 hash: | 6468ec2c43b826c943bbb0c79e219d77 |
| MIME type: | text/plain |
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
lolbin mshta obfuscated
Result
Verdict:
MALICIOUS
Link:
Details
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Score:
1%
Verdict:
Benign
File Type:
Archive
Threat name:
Script-JS.Trojan.Nioc
Status:
Malicious
First seen:
2024-01-26 13:36:03 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
4 of 38 (10.53%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
n/a
Behaviour
Modifies Internet Explorer settings
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Blocklisted process makes network request
Malware Config
Dropper Extraction:
http://91.92.248.152/z
http://91.92.248.152/z/a.png
http://91.92.248.152/z/a.png
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
zip 18785530de0c06d99d817d29d0785470ae108d05f7bc2db218b00d2185ae50af
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.