MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a8cbdf05fa87e002fd7d90b570d3ecd1ae91183059d4c7959677b5cdb9fe804. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4a8cbdf05fa87e002fd7d90b570d3ecd1ae91183059d4c7959677b5cdb9fe804
SHA3-384 hash:	1ea2f137b4005e8a3ff1045b779602712a56b62ba27f9626ae613c2e53e5079687d2fc74e730e08acf7859d8eb49f79b
SHA1 hash:	6a3ac845a8f158e4ed4b68ccc0f837548dfdb02e
MD5 hash:	467e98745c4927c7474f52ee4568bc09
humanhash:	alanine-march-social-pluto
File name:	documento4.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	26'269 bytes
First seen:	2023-03-23 14:17:33 UTC
Last seen:	Never
File type:	js
MIME type:	text/plain
ssdeep	768:M282Y2w2w2w28TVH2h2lyGHATE3AoZWEdecC5pLlIKvQ:kJHwIHAbIecalO
TLSH	T1C1C2BFB50221660F117F2E1E104C6E4EE56928D25FA4BCB052FBF3E1E54632E6712C37
Reporter	JAMESWT_WT
Tags:	EUROSPURGHI Gozi js js2 Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

299

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

sload

Link:

https://www.filescan.io/uploads/641c5fa2009023b71dc28472/reports/b9477550-b8d7-4302-b909-4e5af34df08d/overview

Hybrid Analysis Trojan.Script.ExpKit

Verdict:

Malicious

Labled as:

Trojan.Script.ExpKit

Link:

https://www.hybrid-analysis.com/sample/4a8cbdf05fa87e002fd7d90b570d3ecd1ae91183059d4c7959677b5cdb9fe804

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1200433

Signature

Creates processes via WMI

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a8cbdf05fa87e002fd7d90b570d3ecd1ae91183059d4c7959677b5cdb9fe804/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jkgl34c7vb7aal6x3efvodj6zunosemdawouy6kzm55vzw475aca._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/230323-rl99gsgb98/

Behaviour

Modifies system certificate store

Blocklisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.