MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5
SHA3-384 hash: b1afe375ecefc0718d97807803ce78c1b61e63ab00e7bb5d462e788cccd907110732a9083d74e8479af35e38e5d61f9f
SHA1 hash: b789e7345edf110a5ac67456a34b409062f150cc
MD5 hash: da8947f86da80b4c619c6fdf8a99d8e9
humanhash: lemon-whiskey-double-yankee
File name:35-2023_en.pdf .cmd
Download: download sample
File size:448 bytes
First seen:2023-09-05 12:50:28 UTC
Last seen:2023-12-06 09:19:31 UTC
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 12:eWVjX/DKKLqm/aWVjX/DKKLqV/9rYfxxq7qgi:9VrDvVrDSrYxxOS
TLSH T1BCF0A350142740ABC9D0FB4473174207FFFA21CE7C41D794B188825017AB447C26CAFB
Reporter JAMESWT_WT
Tags:89-96-196-150 cmd

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/64f724362a262962b793d088/reports/a54fa867-2994-49e4-90e0-730778678d95/overview
Verdict:
Suspicious
Labled as:
BAT/Agent.PZY trojan
Link:
https://www.hybrid-analysis.com/sample/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1303595
Signature
Downloads suspicious files via Chrome
Maps a DLL or memory area into another process
Uses cmd line tools excessively to alter registry or file data
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1303595 Sample: 35-2023_en.pdf_.cmd Startdate: 05/09/2023 Architecture: WINDOWS Score: 52 53 Downloads suspicious files via Chrome 2->53 7 msedge.exe 57 270 2->7         started        12 cmd.exe 2 2->12         started        14 msedge.exe 8 2->14         started        16 msedge.exe 10 2->16         started        process3 dnsIp4 49 192.168.2.8, 138, 443, 49751 unknown unknown 7->49 51 239.255.255.250 unknown Reserved 7->51 41 C:\Users\user\AppData\Local\...\content.js, Unicode 7->41 dropped 55 Maps a DLL or memory area into another process 7->55 18 msedge.exe 39 7->18         started        21 msedge.exe 7->21         started        23 msedge.exe 7->23         started        33 4 other processes 7->33 57 Uses cmd line tools excessively to alter registry or file data 12->57 25 msedge.exe 1 10 12->25         started        27 msedge.exe 16 12->27         started        35 3 other processes 12->35 29 msedge.exe 14->29         started        31 msedge.exe 16->31         started        file5 signatures6 process7 dnsIp8 43 part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49773, 49774 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->43 45 204.79.197.200, 443, 49769 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 18->45 47 5 other IPs or domains 18->47 37 msedge.exe 25->37         started        39 msedge.exe 27->39         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gop7oighjxceeznzc63nhy52aqi5mhz42pbsr2ncxlublewiu3sq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230905-q2zbgsfg3t/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments