MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c
SHA3-384 hash:	515658c750f7538ea5cd97cb33534fe2e689e9f1125be70dacdd1b0271d46ba4b4409b7e42a670d4b264a1ec7c5312b4
SHA1 hash:	cd3ae5ae40834064c0e36f663f0a302d78fe09fa
MD5 hash:	5db097161a059f2e4763d606b2fa25f6
humanhash:	aspen-high-neptune-river
File name:	documento.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	31'208 bytes
First seen:	2023-03-23 12:17:33 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:9puzvtUSU5Z+RHlFirGTT07vpbsssz1HD:9iUSUUFirJ7+j
TLSH	T1FBE2C0DBEB5BB5C8DD1C3D92208747D019082C57E424ECF8941B1685FF8B66EB3464BA
Reporter	JAMESWT_WT
Tags:	EUROSPURGHI Gozi isfb js js2 Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

255

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cerber nemucod powercat sload virus

Link:

https://www.filescan.io/uploads/641c437e9c109cf74b2ed426/reports/8539da22-d519-4e1e-83a2-a8ee4eb1528d/overview

Hybrid Analysis Possibl.454097EA

Verdict:

Malicious

Labled as:

Possibl.454097EA

Link:

https://www.hybrid-analysis.com/sample/4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1200313

Signature

Creates processes via WMI

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a658f49bc680e3f8d07042aecde68a357f65e1c72ed7793f91c8fcd39dec53c/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jjsy6sn4nahd7dihaqvozxtiunl7mxq4olwxpe7zdsh42oo6yu6a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230323-pgln8afe53/

Behaviour

Modifies system certificate store

Blocklisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.