MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e7f973b3b85c219b603def41e4729b891faad6dffdea2b271897e90f5fbe33a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7e7f973b3b85c219b603def41e4729b891faad6dffdea2b271897e90f5fbe33a
SHA3-384 hash:	b2eb5b8f7db29e5672bde301e0788b4abfa05d71504591e2d8ba79d23edd73313a6cb39ccdc48ae2bfc00f40024603f6
SHA1 hash:	0fee88475836656ef72d02b3ccccb0b1ef1b348e
MD5 hash:	df3047f16de40e06fd2481b571af16f6
humanhash:	six-grey-nevada-september
File name:	Document_7247_(Feb10).zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	1'046'207 bytes
First seen:	2023-02-10 20:34:47 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 5584
ssdeep	24576:hSLi8NGnureJz+SUzZyHqBZQbEAdU2CedMxN70:hmrGWetXUyHSQN+deCxd0
TLSH	T1742533C471F8551BB87E0B36FCB35360AAA8A2658099F703D4681C170EDFE587BDA12D
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	proxylife
Tags:	file-pumped IcedID pw-5584 zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

153

Origin country :

IE

File Archive Information

This file is a password protected archive. The password is: 5584

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Document_7247_(Feb10).exe
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	739'733'656 bytes
SHA256 hash:	e8a4ca9477af1066f40dd9ba40d43eb21c890f96a43bfe9da9089f2d807c1129
MD5 hash:	400a8c49545ceb670261192c91f66f7e
De-pumped file size:	739'722'752 bytes (Vs. original size of 739'733'656 bytes)
De-pumped SHA256 hash:	1511d078e589838ecb30a849160c3ab7b98d59e255c6a564c85e052faeac30ec
De-pumped MD5 hash:	c3b706da5976c2edca2281980baebf1d
MIME type:	application/x-dosexec
Signature	IcedID

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3267.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7e7f973b3b85c219b603def41e4729b891faad6dffdea2b271897e90f5fbe33a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7e7f973b3b85c219b603def41e4729b891faad6dffdea2b271897e90f5fbe33a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pz7zooz3qxbbtnqd332b4rzjxci7vlln77pkfmtrrf7jb5p34m5a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.