MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DarkCloud

Vendor detections: 7

Intelligence 7 IOCs YARA 8 File information Comments

SHA256 hash:	4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9
SHA3-384 hash:	0e01f9d86335972286a019c736f229ac48736a6f7572f96b54101f30bdd2447b2cb7b69ecf40b4d33adbc87895a2ce46
SHA1 hash:	660fa6d8ad387722bd7503e856abd916b69d03d1
MD5 hash:	3bb7383da4ac4f1f6cce4e8d63b02d1b
humanhash:	fanta-snake-florida-cat
File name:	Orden de compra_OC_8044B804001_________562KB.gz
Download:	download sample
Signature	DarkCloud Create hunting rule
File size:	13'376 bytes
First seen:	2025-08-29 18:34:28 UTC
Last seen:	2025-08-29 18:35:27 UTC
File type:	gz
MIME type:	application/x-rar
ssdeep	192:Icpkz/Rs0a3DI8Ym1N7/qGHGKP1SxoZQRdkZfJJ/keIIqhiU+FjF4sSyv:XktXa3cnIhqGHG21J8d6JJseuh7+NFDv
TLSH	T11452C0A26C7CE3F27F1738EC7343222E8D67743B817CE96C212065878297CAA0530966
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	DarkCloud gz

cocaman

Malicious email (T1566.001)
From: "Gustavo Gomez D. <gustavo.gomez@vialogisticaintegral.com>" (likely spoofed)
Received: "from [45.144.212.134] (unknown [45.144.212.134]) "
Date: "29 Aug 2025 10:01:04 -0700"
Subject: "orden de compra_OC 8044B_804.001.(~562 KB)"
Attachment: "Orden de compra_OC_8044B804001_________562KB.gz"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Orden de compra_OC_8044B804001_________562KB.exe
File size:	27'648 bytes
SHA256 hash:	8820442245e2139c7da613f33710c874cb901902acd5d45b9fe515f001a3fc8b
MD5 hash:	12bcbe99dec3caec1e9c98b192bd8740
MIME type:	application/x-dosexec
Signature	DarkCloud

Vendor Threat Intelligence

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68b1c510eb163e0ec1830fcd

Tags:

underscore autorun

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

base64 obfuscated obfuscated

Link:

https://www.filescan.io/uploads/68b1f2c81c81c34281d85780/reports/16fc270a-64ad-4dc1-9fa1-2125b557325d/overview

Verdict:

Malicious

Labled as:

Trojan.Downloader

Link:

https://www.hybrid-analysis.com/sample/4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9

Verdict:

Malicious

File Type:

rar

First seen:

2025-08-28T16:22:00Z UTC

Last seen:

2025-08-28T16:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9/results?tab=lookup

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout Rar Archive SOS: 0.43

Link:

https://app.malva.re/file/3bb7383da4ac4f1f6cce4e8d63b02d1b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9/

Threat name:

ByteCode-MSIL.Trojan.Mardom

Status:

Malicious

First seen:

2025-08-28 22:59:52 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jxtazkhde44ldmy2sjwyotcwaaiqym3flrztyewtewkr43mlih4q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4de60ca8e32738b1b31a926d874c5600110c33655c733c12d325951e6d8b41f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)