MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 773ffc701c7f24953e6126c129d29b1548aa92568087bcf3232bd0c8b838f8fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	773ffc701c7f24953e6126c129d29b1548aa92568087bcf3232bd0c8b838f8fb
SHA3-384 hash:	1b479fad55fd3ac76c66631bb22bdca8839c79c80221666aa9b911d7ca6c356b77284ad099879a1810bdb4acb0647fb9
SHA1 hash:	174e5114aa8170f5a8993555c0d42e53a7d7e78f
MD5 hash:	8d14aba904ff0e82dc0cd0c2e0c00239
humanhash:	black-sodium-jupiter-moon
File name:	document_133_invoice#PDF.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	402'473 bytes
First seen:	2022-12-06 18:38:57 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: pdf7354
ssdeep	12288:UHncIO7EXQaP1Yxe9UXQwfB3yKC981876+WK:UHcncQAFtHKm862HK
TLSH	T18784237D80C3B5EEFF11AFBF7B39488B656169E8CC14363A6A5244EC57678904C2481F
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	k3dg3___
Tags:	IcedID pw pdf7354 saintrefunda.com zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

183

Origin country :

US

File Archive Information

This file is a password protected archive. The password is: pdf7354

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	document_133_invoice#PDF.msi
File size:	675'840 bytes
SHA256 hash:	070f9169977c766c426e9c1a8161a40f54a068ef7cc1c3090d226e87dc890095
MD5 hash:	76bf2b13ab0bdb12c1b8fc474fb9984e
MIME type:	application/x-msi
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/773ffc701c7f24953e6126c129d29b1548aa92568087bcf3232bd0c8b838f8fb/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o477y4a4p4sjkptbe3astuu3cvekveswqcd3z4zdfpimroby7d5q._file

Hatching Triage icedid

Result

Malware family:

icedid

Alert

Create hunting rule

Score:

  10/10

Tags:

family:icedid campaign:764376559 banker loader trojan

Link:

https://tria.ge/reports/221206-x3scwsfd32/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Enumerates connected drives

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

IcedID, BokBot

Malware Config

C2 Extraction:

saintrefunda.com

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.