MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81c09678b1cc14e45ead80e58a2a1567850f6336ac79055ad74588b48d098238. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 81c09678b1cc14e45ead80e58a2a1567850f6336ac79055ad74588b48d098238
SHA3-384 hash: db59a185a2de2f1b6ee824372fb83297a22b42072d0f162ae1deb03b613a6e859104f5bd6d0b9dc82b0092891a8b36cd
SHA1 hash: bae6a86f394febae3b96d0bfd8944da1c485dcb4
MD5 hash: e7059682cf50645e232d4f4baf98ee19
humanhash: carpet-fillet-golf-mockingbird
File name:Revised Proforma Invoice.RAR
Download: download sample
File size:854'028 bytes
First seen:2021-03-25 10:38:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dU6Gm/7YCMDCDJVXTFpBhViMYx3OuEQhmSfNn44/dV8cy41ZWdLfSepCg29UrgGt:dU6GoMC2iBPAf1Tv64/PFyUZ66e5gcL
TLSH 5B0523E4E28EFAF4782D3A02A2CE23355C8165FA1CCB09F5A8413C51DD981C99D6A5E2
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: urss.dnsracks.com
Sending IP: 103.20.213.246
From: Hussen A. Bagheith <LocalPurchaser3@ayccl.com>
Reply-To: LocalPurchaser3@ayccl.com
Subject: Revised Proforma Invoice_New order Al Saad Trading Co(TOP URGENT)
Attachment: Revised Proforma Invoice.RAR (contains "Revised Proforma Invoice.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
118
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27502.Rar5Heur.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/81c09678b1cc14e45ead80e58a2a1567850f6336ac79055ad74588b48d098238/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-25 10:39:04 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qhajm6frzqkoixvnqdsyukqvm6cq6yzwvr4qkwwxiweljdijqi4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/81c09678b1cc14e45ead80e58a2a1567850f6336ac79055ad74588b48d098238

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 81c09678b1cc14e45ead80e58a2a1567850f6336ac79055ad74588b48d098238

(this sample)

Executable exe bc8bd4a80fbfe4398c1f6e1d06a6a110cf4f7d65e953458f56598b4b1c90fc48

  
Dropping
MD5 001d7a85a049cb0e5274553fe74bfef6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bc8bd4a80fbfe4398c1f6e1d06a6a110cf4f7d65e953458f56598b4b1c90fc48

Comments