MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f
SHA3-384 hash:	206a7b5f853d77e7319bd4de533f10205005d1369a1589bde2eb4980a9c66d503945c62d87414015f4fb35e098a2b3ce
SHA1 hash:	e1fff377a152747503f86ce6a68efe3f764f3ff6
MD5 hash:	2b5393174a183610342d1d87ec6626a7
humanhash:	lima-fix-ten-hawaii
File name:	Order 09082023.chm
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	17'572 bytes
First seen:	2023-08-09 09:11:02 UTC
Last seen:	2023-08-09 12:28:54 UTC
File type:
MIME type:	application/octet-stream
ssdeep	192:FgZSu5dIedZDYnnEllacDvPQuPqkfWS/k681sx+4Prv69MAOIQnjJ/NKZZ:Fgcu5esjja6vPQuyq6QNPryCAOh
TLSH	T1EC82CFF1A3160F20CAEC9F3636F6ADEB79254A63B2ADD0214321871D1494D085BF0DCE
TrID	81.0% (.CHI) Windows HELP Index (17144/6) 18.9% (.CHM) Windows HELP File (4000/1)
Reporter	lowmal3
Tags:	AgentTesla chm ftp-mgcpakistan-com

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

124

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.CHMFamilyAffair.20220927.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Trojan.Script.Heuristic

Verdict:

Malicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lok23onpljtda4sze7evn2hk3g2usmscvqzupdr7r5axmwfwvwpq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/5b95adb9af5a6630725927c956e8ead9b5493242ac33478e3f8f417658b6ad9f