🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9a63ae124bdb1a0329932bdb55c1d95e5c2e0020e1627cf4c5f2342db8e1d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9a63ae124bdb1a0329932bdb55c1d95e5c2e0020e1627cf4c5f2342db8e1d4
SHA3-384 hash: f3c500fe7b600b73d1d1d3dbe04343ffd2a38709c81845ff6f7a035daef35febd0f237d852ce4a0f25cd20ef362ae4a5
SHA1 hash: 61280d5607d354fef12e3211171a7c02e3456267
MD5 hash: 9ae51b450e46a8b09343348398e553e8
humanhash: october-alpha-whiskey-grey
File name:Ev.pdf
Download: download sample
Signature IcedID
Create hunting rule
File size:143'022 bytes
First seen:2023-10-19 16:17:10 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 3072:HUuS5khZBElRLuizU3DjkMMhEKKxzS9cnPeBtx5bOnp4pk2j:QkhZCvLjUqErxQcnmOnapk2j
TLSH T10BE312A099608B40F716DFFD6573333B6AF1F68820747AC1D8AE41A53360E54863DAE9
Reporter proxylife
Tags:IcedID pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
652
Origin country :
DE DE
Vendor Threat Intelligence
Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/6e9a63ae124bdb1a0329932bdb55c1d95e5c2e0020e1627cf4c5f2342db8e1d4/results/dashboard
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/653156bb10dbe5fb92cf2300/reports/988838d3-884e-4091-b676-3d3380b71d86/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6e9a63ae124bdb1a0329932bdb55c1d95e5c2e0020e1627cf4c5f2342db8e1d4
Label:
Benign
Suspicious Score:
9/10
Score Malicious:
1%
Score Benign:
9%
Link:
https://www.malware.ai/gui/files/?id=53f2485c-7059-41d5-9707-0bb917d68f75
Result
Threat name:
IcedID
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1328822
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Changes memory attributes in foreign processes to executable or writable
Downloads files with wrong headers with respect to MIME Content-Type
Found malware configuration
Found suspicious ZIP file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Snort IDS alert for network traffic
Suspicious execution chain found
Tries to detect virtualization through RDTSC time measurements
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected IcedID
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1328822 Sample: Ev.pdf Startdate: 19/10/2023 Architecture: WINDOWS Score: 100 65 mistulinno.com 2->65 67 seedkraproboy.com 2->67 69 joekairbos.com 2->69 89 Snort IDS alert for network traffic 2->89 91 Found malware configuration 2->91 93 Malicious sample detected (through community Yara rule) 2->93 95 5 other signatures 2->95 13 chrome.exe 16 2->13         started        16 Acrobat.exe 20 71 2->16         started        signatures3 process4 dnsIp5 85 192.168.2.4, 137, 138, 443 unknown unknown 13->85 87 239.255.255.250 unknown Reserved 13->87 18 unarchiver.exe 4 13->18         started        20 chrome.exe 13->20         started        23 AcroCEF.exe 69 16->23         started        process6 dnsIp7 25 cmd.exe 2 2 18->25         started        28 7za.exe 2 18->28         started        71 skyalarabia.com 198.38.94.115, 443, 49755, 49756 SERVERCENTRALUS United States 20->71 73 clients.l.google.com 142.251.2.100, 443, 49753 GOOGLEUS United States 20->73 75 5 other IPs or domains 20->75 30 AcroCEF.exe 2 23->30         started        process8 signatures9 109 Uses ping.exe to sleep 25->109 111 Uses ping.exe to check the status of other devices and networks 25->111 32 wscript.exe 1 1 25->32         started        34 conhost.exe 25->34         started        36 conhost.exe 28->36         started        process10 process11 38 cmd.exe 1 32->38         started        signatures12 103 Uses ping.exe to sleep 38->103 41 rundll32.exe 38->41         started        43 curl.exe 2 38->43         started        47 conhost.exe 38->47         started        49 2 other processes 38->49 process13 dnsIp14 51 rundll32.exe 41->51         started        83 128.140.120.227, 49761, 80 HETZNER-ASDE Germany 43->83 63 C:\Users\user\AppData\Local\Temp\5t.dll, PE32+ 43->63 dropped file15 process16 signatures17 97 Changes memory attributes in foreign processes to executable or writable 51->97 99 Maps a DLL or memory area into another process 51->99 101 Queues an APC in another process (thread injection) 51->101 54 svchost.exe 51->54 injected process18 dnsIp19 77 mistulinno.com 104.21.85.50, 49765, 80 CLOUDFLARENETUS United States 54->77 79 joekairbos.com 104.248.81.48, 443, 49768, 49769 DIGITALOCEAN-ASNUS United States 54->79 81 seedkraproboy.com 104.223.118.109, 443, 49772, 49774 ASN-QUADRANET-GLOBALUS United States 54->81 59 C:\Users\user\AppData\Local\...xtiom4.dll, PE32+ 54->59 dropped 61 C:\Users\user\AppData\...\spread_x32.dat, PE32+ 54->61 dropped 105 Benign windows process drops PE files 54->105 107 Tries to detect virtualization through RDTSC time measurements 54->107 file20 signatures21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9a63ae124bdb1a0329932bdb55c1d95e5c2e0020e1627cf4c5f2342db8e1d4/
Threat name:
Document-PDF.Trojan.IcedID
Create hunting rule
Status:
Suspicious
First seen:
2023-10-19 15:12:33 UTC
File Type:
Document
Extracted files:
1
AV detection:
6 of 37 (16.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2nghlqsjpnruazjsmv5wvob3fpfylqaedqwe7huyxzdilny4hka._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments