MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49a413dcaf59ef360c0d96dccd27afee313d6324e1a34009494fa90f36270e70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	49a413dcaf59ef360c0d96dccd27afee313d6324e1a34009494fa90f36270e70
SHA3-384 hash:	1f1de0e36806918a7d6512f6257234317ec520b6fa704d14c79285978791ded61553249ba993ba73dc5d1bfdd597dc96
SHA1 hash:	f0ecea0af996d0ee4f840029b7d9e86b76aef3a0
MD5 hash:	28e8b5da4832c48419910dbaa77f1585
humanhash:	august-timing-equal-south
File name:	Item list.Pdf.z
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	650'791 bytes
First seen:	2024-09-09 02:50:21 UTC
Last seen:	2024-09-09 06:59:11 UTC
File type:	z
MIME type:	application/x-rar
ssdeep	12288:YwiN+OPeka8sQXKeIENvt1IsXevnABu0D+DLIjjJlqJiWBpKtCPTo:YwKea/Ky7er0CDqHtWB1PTo
TLSH	T10CD423329D24D5E57D690051D603B6F9EE8F157CE94AAABCE0F7082B62CC36124AB173
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook z

cocaman

Malicious email (T1566.001)
From: "Giorgi Namgaladze <g.namgaladze@rustavisteel.ge>" (likely spoofed)
Received: "from rustavisteel.ge (unknown [185.169.4.114]) "
Date: "8 Sep 2024 23:57:01 -0700"
Subject: "Inquiry"
Attachment: "Item list.Pdf.z"

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

119

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Item list.exe
File size:	693'248 bytes
SHA256 hash:	a1c124aa85ef07d4c39706dcd012d208576a4b08ec24106fd28d4c5847f9afc9
MD5 hash:	9ef9cffb40d3911e46cb798daa08b46f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20240909-0636.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66de625c2b43a28a71757cd2

Tags:

Banker Encryption Execution Generic Network Msil Dexter

FileScan.io

Gathering data

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/49a413dcaf59ef360c0d96dccd27afee313d6324e1a34009494fa90f36270e70

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49a413dcaf59ef360c0d96dccd27afee313d6324e1a34009494fa90f36270e70/

ReversingLabs TitaniumCloud Win32.Trojan.Leonem

Threat name:

Win32.Trojan.Leonem

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-09 02:50:24 UTC

File Type:

Binary (Archive)

Extracted files:

7

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jgsbhxfplhxtmdans3om2j5p5yyt2yze4gruackjj6uq6nrhbzya._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/49a413dcaf59ef360c0d96dccd27afee313d6324e1a34009494fa90f36270e70