🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76b9a531e2e41474dae479ca56e9611376cf3eced4e2d2ac78ee973eaed33a51. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SilentBuilder


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76b9a531e2e41474dae479ca56e9611376cf3eced4e2d2ac78ee973eaed33a51
SHA3-384 hash: 6006db577ad65e54b8cb5ceaa15bf585b8cacea52be3293b13109f05121b929a240d353f18d4f74800265c2451114cc4
SHA1 hash: c49453878512c45f87fbd709a02455081076f2f6
MD5 hash: b37a22ae636d0f5c8463c17162b97b72
humanhash: eleven-equal-alabama-cold
File name:contract_2815_2_claim-11.zip
Download: download sample
Signature SilentBuilder
Create hunting rule
File size:283'734 bytes
First seen:2020-12-18 17:00:49 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:f6VWs/F7qycRYDlGgVbyBQeErpBPJiMvuDUkF32pb/7+0BQm0:zs/F7RxkgJyBGJzQ98pbKo0
TLSH 4A5423527997621C7A3022BC33C7D6EB4D75B113A5BA7E11C3818595FE07983A6327E0
Reporter abuse_ch
Tags:SilentBuilder zip


Avatar
abuse_ch
Malspam distributing SilentBuilder:

HELO: smtp01.emerald.cmh.synacor.com
Sending IP: 208.47.184.7
From: jmbuzzard@wavecable.com
Subject: RE: PIANO DI RIENTRO PRATICA CO4042791 TRUCCO FEDERICA
Attachment: contract_2815_2_claim-11.zip (contains "document-891775316.xls")

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200416.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.URLDOWNLOADTOFILE.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.URLDOWNLOADTOFILE.200415.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4MagicPalmersArcade.20201207.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76b9a531e2e41474dae479ca56e9611376cf3eced4e2d2ac78ee973eaed33a51/
Threat name:
Document-Excel.Trojan.Valyria
Create hunting rule
Status:
Malicious
First seen:
2020-12-18 17:01:05 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o242kmpc4qkhjwxephffn2lbcn3m6pwo2trnfldy52lt5lwthjiq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76b9a531e2e41474dae479ca56e9611376cf3eced4e2d2ac78ee973eaed33a51

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

SilentBuilder

zip 76b9a531e2e41474dae479ca56e9611376cf3eced4e2d2ac78ee973eaed33a51

(this sample)

SilentBuilder

Excel file xls 4e380065d1bf7c83b5d986c190cf8886046cf91e7408573d67fe01203efec1a2

  
Dropping
MD5 07be2bbb25c6af7c0ee124dd823196e6
  
Dropping
SilentBuilder
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4e380065d1bf7c83b5d986c190cf8886046cf91e7408573d67fe01203efec1a2

Comments