MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26e2294ae5f9a40530ee748e30bcab51f64675604c06234ff9d0ab5bd0ea5e4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26e2294ae5f9a40530ee748e30bcab51f64675604c06234ff9d0ab5bd0ea5e4d
SHA3-384 hash: b9bf58ff50ccdd42028f675ce78afc60287ada4de9542ba02a5a769b0a784291dcc309b7e2381e7e2abdd212509e1ee1
SHA1 hash: 4e728585a4ba3adceffc9781bc57cd6a886c4c25
MD5 hash: d78b92d2a899a71f379bba53fa1c5abf
humanhash: bravo-gee-march-virginia
File name:#4725162.zip
Download: download sample
File size:2'499'676 bytes
First seen:2020-10-29 06:23:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 49152:/v5gv0xhYhfoyBseSoktQp3jn/aveTMzP841fKo0H8gxzK9/2yZ:KsQB/SoeQV2WTMY410H80e
TLSH 11C533C44917CE0BA112C1E84C6F74EE14578F9EA40ABD38C8FD8E28B4BCD9B6B84755
Reporter cocaman
Tags:CVE-2017-11882 zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""DHL.com" <info@alfagroupp.com>"
Received: "from alfagroupp.com (unknown [194.113.234.203]) "
Date: "Thu, 29 Oct 2020 06:22:31 +0000"
Subject: "DHL: SHIPMENT #4725162 ISSUE"
Attachment: "#4725162.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeRTF-2.UNOFFICIAL
Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.170830.UNOFFICIAL
Create hunting rule

MiscreantPunch.RTF.2017-0199.Obfus.171711.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.RTFFakeVersionWithObjUpdateUKSurfMix.20200514.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EQPentaverateTheKernelWithHisWeeBeadyEyes.20200616.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26e2294ae5f9a40530ee748e30bcab51f64675604c06234ff9d0ab5bd0ea5e4d/
Threat name:
Document-Office.Exploit.CVE-2017-11882
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 15:59:09 UTC
File Type:
Binary (Archive)
Extracted files:
25
AV detection:
16 of 47 (34.04%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nemucod
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/26e2294ae5f9a40530ee748e30bcab51f64675604c06234ff9d0ab5bd0ea5e4d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip 26e2294ae5f9a40530ee748e30bcab51f64675604c06234ff9d0ab5bd0ea5e4d

(this sample)

Word file doc 81476a0591455602ec96e76fd76d781dc2da872e3c1909b58bda58a1851f6099

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 81476a0591455602ec96e76fd76d781dc2da872e3c1909b58bda58a1851f6099

Comments