MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e9908277fc5dcee1a5ebc2d77e1971300e0449d0dce9213f0e2648b7780650e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4e9908277fc5dcee1a5ebc2d77e1971300e0449d0dce9213f0e2648b7780650e
SHA3-384 hash:	16ab1742212a33aebb835f0577d6583d7600f8e2b183566a45fcbb7d6f648bd9f2b2011f552e85452a4d1b71feff7ce4
SHA1 hash:	dbd90cfef2e4b1fd371d2d662378c39172439081
MD5 hash:	0d12e4bd0e06802281627a7b0370f327
humanhash:	kentucky-sink-lithium-idaho
File name:	CGMP1279_7140970.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	366'221 bytes
First seen:	2023-10-11 23:26:07 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: W1289
ssdeep	6144:tJsVW7lVspDsDATMdazwPaff+Cxr/HZT6laHQe05ykWKzDbSspp:/sVYQDsETNzwP0f+ShWl805y8z3Sup
TLSH	T197742373DD7050A6FCF2CF66306F1126687F20B7DF2B4252EB5423AE05A4912650BEB9
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	gestionhqse-com IcedID p-W1289 pw-W1289 zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

150

Origin country :

IT

File Archive Information

This file is a password protected archive. The password is: W1289

This file archive contains 2 file(s), sorted by their relevance:

Relevant files 2

File name:	Faq[2023.10.11_08-07].txt
File size:	172 bytes
SHA256 hash:	7ffe5368ab3c19553500da62fb5c35184fd7820657cc8085550f3fe324e68111
MD5 hash:	f0db1b3ddc7a04e8397e2649a3c8a743
MIME type:	text/plain
Signature	IcedID

File name:	statement[2023.10.11_08-07].vbs
File size:	1'037'246 bytes
SHA256 hash:	b8c26e94d120e5193d02e67b46313427744398e3654c9c0f43b6e517d89013b4
MD5 hash:	c2ed082344dfcd3ef0a19785d7f19bda
MIME type:	text/plain
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4e9908277fc5dcee1a5ebc2d77e1971300e0449d0dce9213f0e2648b7780650e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4e9908277fc5dcee1a5ebc2d77e1971300e0449d0dce9213f0e2648b7780650e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j2mqqj37yxoo4gs6xqwxpymxcmaoare5bxhjee7q4jsiw54amuha._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.