MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 930ca9a097c11bd5863a792bb24fd50984aed402f8f4eab93eceeb61fbddea15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 930ca9a097c11bd5863a792bb24fd50984aed402f8f4eab93eceeb61fbddea15
SHA3-384 hash: d7e386b8a48638b0269b09434ad47648a1c522792d1d1a8eb53d21fc6f9d8e9c9055714866c16f0a6797899fd912be61
SHA1 hash: ea86ece42d846acfe7813fc095674df63d617a32
MD5 hash: dda44442bacc3e96cd427e41f09343f6
humanhash: autumn-south-oklahoma-oklahoma
File name:Quotation2.7z
Download: download sample
File size:793'904 bytes
First seen:2020-12-17 08:29:22 UTC
Last seen:2020-12-17 08:35:35 UTC
File type: 7z
MIME type:application/x-7z-compressed
ssdeep 12288:3NLeJhaeTy+WWeo5A5YI/qnMHJbcN4DwjHqU3kPxzmojkPZoQ2:3NLCIeG+WWeo5A5rCnMpbe4hHAoQj2
TLSH 9DF433D9BA29872EE515F332B2F0471710582AAA378E6C2057EC2C9571460B7CE476EB
Reporter abuse_ch
Tags:7z


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: abcdpins.com
Sending IP: 45.35.101.8
From: sale02@abcdpins.com
Subject: RE: End Of Quater Perviously Sent quotation PO0118-12/20 Batch0271231 2020
Attachment: Quotation2.7z (contains "Quotation.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/930ca9a097c11bd5863a792bb24fd50984aed402f8f4eab93eceeb61fbddea15/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-17 08:30:07 UTC
File Type:
Binary (Archive)
Extracted files:
34
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=smgktiexyen5lbr2pev3et6vbgck5vac7d2ovoj6z3vwd6655ikq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/930ca9a097c11bd5863a792bb24fd50984aed402f8f4eab93eceeb61fbddea15

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

7z 930ca9a097c11bd5863a792bb24fd50984aed402f8f4eab93eceeb61fbddea15

(this sample)

Executable exe 0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52

  
Dropping
MD5 33ea75b804fa5b36e6d7efd2742aff03
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b55a1e1d624408e21aba91fc437c256dee64731ea9454700cc0f5448dd00f52

Comments