MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 635f44be32090d6e02516facc7eb9c5780743e774e290cc2c5e496cf9904ed51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 635f44be32090d6e02516facc7eb9c5780743e774e290cc2c5e496cf9904ed51
SHA3-384 hash: fed904d13c67b94a9a1aed0fe3e8dcb4691721d2ba514abdd4958e96905658d8416924401d6a484714e91400c926b826
SHA1 hash: 2e5233f7b5be1e305248eaffbd9e05f3dafb9d89
MD5 hash: 134f4d0d6937384d0711ee3132c4f68f
humanhash: north-lemon-berlin-happy
File name:DHL-Overdue_Account_Letter.wim.001
Download: download sample
File size:817'950 bytes
First seen:2022-04-16 06:49:59 UTC
Last seen:2022-04-16 06:56:35 UTC
File type:unknown
MIME type:application/x-ms-wim
ssdeep 12288:hVEfOLgjSqib5T2fWdyfG657PKLi3628T+WQIkFWLvcm/AKhgR081Jrx62tXBctS:hKjMb5T2C+7i23T9hJbLIusQUHw
TLSH T10305BFA9785071DEC813D533D9E6CCB0FA9038BA930B7397B0932769AD5C892CE151F6
TrID 53.3% (.WIM) Windows Imaging Format (WIM) (8002/2)
46.6% (.WIM/WIM2/SWM/ESD/PPKG) Windows Imaging Format (generic) (7000/1)
Reporter cocaman
Tags:001 DHL


Avatar
cocaman
Malicious email (T1566.001)
From: ""Alexis Zeller (DHL US)"<dhlsender@dhl.com>" (likely spoofed)
Received: "from dhl.com (unknown [103.156.93.66]) "
Date: "14 Apr 2022 09:48:57 -0700"
Subject: "Fwd: [URGENT!] :DHL Overdue Account Letter///APRIL, 14-04-2022 "
Attachment: "DHL-Overdue_Account_Letter.wim.001"

Intelligence

File Origin
# of uploads :
6
# of downloads :
431
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.48871690.21622.30064.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/625a671d482f2f41caba8857/reports/a3e78eb1-48a5-46d6-9f6d-de076d152d76/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/635f44be32090d6e02516facc7eb9c5780743e774e290cc2c5e496cf9904ed51/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-04-14 17:17:42 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
5 of 42 (11.90%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/635f44be32090d6e02516facc7eb9c5780743e774e290cc2c5e496cf9904ed51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

unknown 635f44be32090d6e02516facc7eb9c5780743e774e290cc2c5e496cf9904ed51

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments