MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 349d47be4a38242b25549567438628126f32f8ab236762d804b578bcbadbaeff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	349d47be4a38242b25549567438628126f32f8ab236762d804b578bcbadbaeff
SHA3-384 hash:	6860e86439980179be335094025117c87562e1093c42f036036fc8c9bd64bf4238ffa594df4189f8c8ee455af16994cb
SHA1 hash:	725df0fb6b973c443a4b62860ae6bde13a57d1d7
MD5 hash:	7fe3a539ee8b81c55ad6ad69e4e49101
humanhash:	crazy-london-virginia-finch
File name:	Fattura 2203-23_012(9).zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	1'960 bytes
First seen:	2023-03-23 13:19:39 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	48:9O6Iru/6nf2aZkHYFpL4gfpdruM5wxpeM6IKAQpBIOUlLpG449Z:0zq/6f2WkH2pL4AbvM6O4tUZpG449Z
TLSH	T13441EA4DA5BC8508DBC287735EC28FC7717CB3191F14A1FA901968802B61334CBA2A65
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	EUROSPURGHI Gozi Ursnif zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

114

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Fattura 3586 2023-300953.js
File size:	6'504 bytes
SHA256 hash:	9e9bbcc818ebd460f4f0d7f66a32142427232a2f42316c93ee65d809c0e0927f
MD5 hash:	069f8ce804df7ea844d09777f28efd56
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

JS File

Link:

https://app.docguard.net/349d47be4a38242b25549567438628126f32f8ab236762d804b578bcbadbaeff/results/dashboard

Payload URLs

URL

File name

https://google.com

JS File

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/641c520c8f3f4544f6cb97c2/reports/8af911f1-b6d2-4a3f-b82d-0dd6f5f71495/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Malicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/349d47be4a38242b25549567438628126f32f8ab236762d804b578bcbadbaeff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/349d47be4a38242b25549567438628126f32f8ab236762d804b578bcbadbaeff/

ReversingLabs TitaniumCloud Win32.Dropper.Generic

Threat name:

Win32.Dropper.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-03-23 13:20:11 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

6 of 37 (16.22%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gsouppskhascwjkusvtuhbricjxtf6flentwfwaewv4lzow3v37q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230323-qrtcgsga49/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.