MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a580c2e44cab48fc808437a71360c25bf7b5644c5e757ba17cdbfe309b5d3d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4a580c2e44cab48fc808437a71360c25bf7b5644c5e757ba17cdbfe309b5d3d8
SHA3-384 hash:	87581549901f749f5185dad41db673454b73a8ebbd2675d5e244b4dca9cfaa420a774582dfc7f9a03e8b4dd1197d7813
SHA1 hash:	31c0f1869f0f3b5aeba31f97c18a39fd1919d5f7
MD5 hash:	c746b41bbb537f4bc8f76fa2e93ae9a3
humanhash:	maryland-nebraska-bluebird-delaware
File name:	Scan00038122344.PDF.z
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	650'803 bytes
First seen:	2024-09-09 06:02:43 UTC
Last seen:	Never
File type:	z
MIME type:	application/x-rar
ssdeep	12288:mwiN+OPeka8sQXKeIENvt1IsXevnABu0D+DLIjjJlqJiWBpKtCPTx:mwKea/Ky7er0CDqHtWB1PTx
TLSH	T187D433329D24D5F57D690051D603B6F9EE8F157CE94AAABCE0F7082762CC36124AB1B3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook z

cocaman

Malicious email (T1566.001)
From: "Ann King <ann.king@panthers.com.au>" (likely spoofed)
Received: "from panthers.com.au (unknown [185.169.4.114]) "
Date: "8 Sep 2024 23:01:16 -0700"
Subject: "Remittance Advice"
Attachment: "Scan00038122344.PDF.z"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

113

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Scan00038122344.exe
File size:	693'248 bytes
SHA256 hash:	a1c124aa85ef07d4c39706dcd012d208576a4b08ec24106fd28d4c5847f9afc9
MD5 hash:	9ef9cffb40d3911e46cb798daa08b46f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66de625c2b43a28a71757cd2

Tags:

Execution Network Stealth Msil

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4a580c2e44cab48fc808437a71360c25bf7b5644c5e757ba17cdbfe309b5d3d8

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a580c2e44cab48fc808437a71360c25bf7b5644c5e757ba17cdbfe309b5d3d8/

ReversingLabs TitaniumCloud Win32.Trojan.Jalapeno

Threat name:

Win32.Trojan.Jalapeno

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-09 04:25:12 UTC

File Type:

Binary (Archive)

Extracted files:

7

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jjmaylsezk2i7saiin5hcnqmew7xwvseyxtvpoqxzw76gcnv2pma._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4a580c2e44cab48fc808437a71360c25bf7b5644c5e757ba17cdbfe309b5d3d8