MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307
SHA3-384 hash:	ddfa6fe271827999b12afa1182451f0730a2af784352eeca69875e4623d2b8fe5a28a0941211f5ba068ff8633aa2da27
SHA1 hash:	6c8d5af03cdc48cd99ad53e9af60847231672c35
MD5 hash:	0f69a35171f141b851997528744c0ea1
humanhash:	pasta-single-seventeen-blue
File name:	distinctio.c.bat
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	141 bytes
First seen:	2023-07-19 02:28:32 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	3:3J3OE8IbU0MjNEqQRFomyViE2J5xAIwLW7W+X3x6QQFIzUv:3J3r82LUUjohn23fwLWSK6DFW2
TLSH	T195C02B9088810217FA4385527FF0608DB4200CAC3CD127A19500AD24004D10C736B3A1
Reporter	JAMESWT_WT
Tags:	20000 bat Gozi Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

161

Origin country :

IT

Vendor Threat Intelligence

ANY.RUN Suspicious

Malware family:

n/a

ID:

1

File name:

INV-Details-Jul2023.pdf.js

Verdict:

Suspicious activity

Analysis date:

2023-07-18 21:41:05 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/029d1aeb-23cb-4107-99a8-6ca5773218d3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/424395/

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/64b74a6ef3c193545ac6bbd6/reports/b1d5af3a-5535-4c9c-9816-e3f3a9b409fe/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1275572

Signature

Multi AV Scanner detection for domain / URL

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lzhlj66hda4rjqiqxcc6oicpuk7nny2gz7sh6wr6zfqaxst2gmdq._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/230719-cyj6hafh9y/

Behaviour

Suspicious use of WriteProcessMemory

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/5e4eb4fbc7183914c110b885e7204fa2bed6e346cfe47f5a3ec9600bca7a3307

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/424395/