MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e
SHA3-384 hash:	eaf6886d5e1dd21991332792f36a9ad624be596b62bbf70e40e1f1621ce3c577fa17071b52304a870c13c22cf8e2ee03
SHA1 hash:	ec9de894d7cb09ed3940db31dfc7a39cc1280acd
MD5 hash:	2cf09341b87d20404a6d824305ea5419
humanhash:	eighteen-hot-diet-speaker
File name:	EXPORT INVOICE.pdf.scr
Download:	download sample
File size:	808'448 bytes
First seen:	2022-05-12 09:19:27 UTC
Last seen:	2022-05-12 10:12:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'237 x AgentTesla, 20'488 x Formbook, 12'372 x SnakeKeylogger)
ssdeep	12288:cWRXIfWktOMzKcDOGjBTu2KSgaLfqGC7vh9KBYhLWWZ0u9zfLWt6l/4MKOC6ZEKA:ciXIfWcKwj9wSgajqh7J9K6hLPSu9O
Threatray	889 similar samples on MalwareBazaar
TLSH	T1B905BE9872D0B5AECB07C93289545C25A9203C67439AD20B6CC736DFE9BD69ECE041F3
TrID	69.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 9.9% (.EXE) Win64 Executable (generic) (10523/12/4) 6.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.2% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	64e4c69696f2f0d4 (1 x NanoCore)
Reporter	adrian__luca
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

234

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

EXPORT INVOICE.pdf.scr

Verdict:

Suspicious activity

Analysis date:

2022-05-12 09:17:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9a05c081-f08b-4018-ac30-5879cbf4022f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/270037/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Launching the default Windows debugger (dwwin.exe)

Creating a process with a hidden window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

obfuscated packed

Link:

https://www.filescan.io/uploads/627cd15389dc6403e777c282/reports/eb1a6eec-395d-4080-aeb2-f6a27f223fef/overview

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/aebfeb51-b9cf-4662-bf39-ba69209dff58

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/992581

Signature

Antivirus / Scanner detection for submitted sample

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Uses an obfuscated file name to hide its real file extension (double extension)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e/

Threat name:

Win32.Trojan.AgentTesla

Status:

Malicious

First seen:

2022-05-11 21:36:35 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fmqyqxdiz6f45y56pyefoq3scmfefr2kar5r7frmyxrhbo33kq7a._file

Verdict:

suspicious

348c4a66d4844d4636c90862d8b9c481e58fd38df59ba25a4b46744868e46800

53276d0a0acc73fb550b5b29cc686c0e646ee69333e803496cac726b337b5515

58d325351b79f84d68ef5586de43ec3708fc0e142a83007fddbd7a05c20021ce

5e78cf499e73d06b346f84de0a36188587cb0789a9a02899d3e5d0dcd4a15520

b1d6a4b94c5508ac4948d91498b574710dcc2bae3ab4eff42ffb889eca5a97a2

dd3d5e3e01b86223fd3a517b9d153fa85a842d4b816b18f747d85df181e1a38b

eba97a314b1c02ecdd75fe691c6883b214dc0b239d0ba39b7d578162b5218ad0

+ 879 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/220512-larecaefdn/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Unpacked files

SH256 hash:

c206122a7336385be557580c114ac0923192f61bc8f77aa58c898135438399f9

MD5 hash:

6c9e813248a01432890c476813d210b8

SHA1 hash:

fd54aa3af58fc3a88cb3fd6753d773cd6c51b7f8

Link:

https://www.unpac.me/results/6cf0a091-e5cd-437c-a7b5-41e3a2f5e590/

SH256 hash:

2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e

MD5 hash:

2cf09341b87d20404a6d824305ea5419

SHA1 hash:

ec9de894d7cb09ed3940db31dfc7a39cc1280acd

Link:

https://www.unpac.me/results/6cf0a091-e5cd-437c-a7b5-41e3a2f5e590/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.38

Link:

https://yomi.yoroi.company/submissions/2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

exe 2b21885c68cf8bcee3be7e08574372130a42c74a047b1f962cc5e270bb7b543e

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/270037/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample