MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33adc2cce486d0ea75416d205d1fcc1589bb6070720b6e1bee08128dfb8fed8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33adc2cce486d0ea75416d205d1fcc1589bb6070720b6e1bee08128dfb8fed8d
SHA3-384 hash: bc18f91b2f64f7988f989f5a96e6de96bbc050a58129e671abc6ab3b93bbd44d6f51de1c41a235df9bbd01231b698bcb
SHA1 hash: a1d8dacbbc830a7206e1fe9668f90b0565d0ab63
MD5 hash: 5f97e9cfbe93d1c96e199ce809b13d52
humanhash: six-twelve-cup-july
File name:tmps0w_zkux
Download: download sample
File size:147'446 bytes
First seen:2022-01-25 15:58:26 UTC
Last seen:2022-01-25 17:45:11 UTC
File type:unknown
MIME type:application/CDFV2
ssdeep 3072:d7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIfGxe:pcKoSsxzNDZLDZjlbR868O8K0c03D38K
TLSH T120E35A6576B5C9F6D60403B10AD2CAFA2327FC739E5603E33199B31E1FB91509AC26C6
Reporter Cryptolaemus1
Tags:doc Emotet epoch4

Intelligence

File Origin
# of uploads :
2
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.CROIndirectionGamesLeave.20210428.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.CROMiscreantNeuralLinkTerra.20210721.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLSPROCB64.11.UNOFFICIAL
Create hunting rule

MiscreantPunch.EvilMacro.PSHELLB64INVOKEDASHWINVOKEDASHW.4.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.4.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.START_PROCES.211006B64.1.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXRSTRGOOD.START_PROC.211028B64.1.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
macros macros-on-open print.exe
Link:
https://www.filescan.io/uploads/61f01e4f8581cbffe082e181/reports/889aaa7f-0960-4331-a469-f91390dff4e0/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/33adc2cce486d0ea75416d205d1fcc1589bb6070720b6e1bee08128dfb8fed8d
Details
Base64 Encoded Powershell Directives
Detected one or more base64 encoded Powershell directives.
Base64 Encoded URL
Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro with File System Write
Detected macro logic that can write data to the file system.
Macro with File System Read
Detected macro logic that can read data from the file system.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33adc2cce486d0ea75416d205d1fcc1589bb6070720b6e1bee08128dfb8fed8d/
Threat name:
Script-Macro.Dropper.Logan
Create hunting rule
Status:
Malicious
First seen:
2022-01-25 16:17:23 UTC
AV detection:
7 of 43 (16.28%)
Threat level:
  3/5
Malware family:
Emotet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/33adc2cce486/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/33adc2cce486d0ea75416d205d1fcc1589bb6070720b6e1bee08128dfb8fed8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments