MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 84da8351b5eae6322fbd9893d8ca0eee67fd4c33315ecd40ddc9e5736ced2d0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 84da8351b5eae6322fbd9893d8ca0eee67fd4c33315ecd40ddc9e5736ced2d0b |
|---|---|
| SHA3-384 hash: | a8df4f64a01b064048081c95c2b9f3f72ddf8ba1bba7aeade11f08d31d073c4275819dd7026e8131f054a6d1a5eec10c |
| SHA1 hash: | a367517ec7411378b37c48aab5909947c1a9c3d8 |
| MD5 hash: | 570c03dd3d21db62de19e0ececb7d6f5 |
| humanhash: | april-johnny-april-charlie |
| File name: | Quote#PSAK002 Abka International General Trading.exe |
| Download: | download sample |
| File size: | 561'664 bytes |
| First seen: | 2020-10-19 13:13:09 UTC |
| Last seen: | 2020-10-19 14:21:49 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:hKzewGLdb7DcBdDEPTWJgkZkz9BmZRnaYMPYMHEGO:hKK/xsiXtHEG |
| Threatray | 5 similar samples on MalwareBazaar |
| TLSH | 2BC4A59961CE2C77EAB4DA3C6FA6C04298F03DE78145E2244EC5FEDB90772052E87D19 |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:From: Arsalan Aftab <office@jardipondi.com>
Subject: AW: Quote#VCPF2020
Attachment: QuotePSAK00.lzh (contains "Quote#PSAK002 Abka International General Trading.exe")
Intelligence
File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Creating a window
DNS request
Launching a process
Creating a process with a hidden window
Sending a TCP request to an infection source
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
48 / 100
Signature
.NET source code references suspicious native API functions
Connects to a pastebin service (likely for C&C)
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Status:
Malicious
First seen:
2020-10-19 13:15:07 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Delays execution with timeout.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
84da8351b5eae6322fbd9893d8ca0eee67fd4c33315ecd40ddc9e5736ced2d0b
MD5 hash:
570c03dd3d21db62de19e0ececb7d6f5
SHA1 hash:
a367517ec7411378b37c48aab5909947c1a9c3d8
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe 84da8351b5eae6322fbd9893d8ca0eee67fd4c33315ecd40ddc9e5736ced2d0b
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.