MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22ac35f2d72b2dc4639020565c7f91d35ee633604d6055b24bba5b06c0cdc919. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 22ac35f2d72b2dc4639020565c7f91d35ee633604d6055b24bba5b06c0cdc919
SHA3-384 hash: 0c52030ea196e9fd7ce4446c72f12816c3d752d049bab640ce226ef022aed7f2d8ec76cd50b37476367eced4ec7bbf26
SHA1 hash: 5399b88f51616d879ad453f20f454ae780d8e9ec
MD5 hash: 7033e73400c0f1022d4bbf4fb85e5393
humanhash: helium-two-carolina-kilo
File name:certificate Insurance attachment.pdf.z
Download: download sample
File size:14'298 bytes
First seen:2021-02-24 07:02:03 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 384:ahOkIDkpsOekCnXDOWqDdfVOroWcTS71KMq/eUhzrBH:aTHpsbkC3qCFcTeMbzV
TLSH 6552CF4456C3B4C45B8750E63C5DD5BFFF524C9A82F37BE91078E5E8D9860E830294DA
Reporter abuse_ch
Tags:Endurance z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: gateway33.websitewelcome.com
Sending IP: 192.185.146.119
From: Kamonwan@g4si.com
Subject: Certificate of insurance
Attachment: certificate Insurance attachment.pdf.z (contains "Fireman.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/22ac35f2d72b2dc4639020565c7f91d35ee633604d6055b24bba5b06c0cdc919/
Threat name:
ByteCode-MSIL.Downloader.BaseLoader
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 07:02:09 UTC
AV detection:
13 of 47 (27.66%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ekwdl4wxfmw4iy4qeblfy74r2npomm3ajvqflmslxjnqnqgnzemq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

z 22ac35f2d72b2dc4639020565c7f91d35ee633604d6055b24bba5b06c0cdc919

(this sample)

Executable exe 5abccf199b1e503db7c810a9dcbe1310b6a6b78441b091dae6f45c92d3c3add1

  
Dropping
MD5 e7e3ab5c81e4ebdbda25d12d94790ce6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5abccf199b1e503db7c810a9dcbe1310b6a6b78441b091dae6f45c92d3c3add1

Comments