MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8 |
|---|---|
| SHA3-384 hash: | e9a4f91ee37aa6b5e998533a14191bb51d5c62979ca494081acf863fd55d33116b2aaa196070bc79ad62b20704b11239 |
| SHA1 hash: | e36e612d24923129c9be88703d1544965836d72a |
| MD5 hash: | a095b722591343954b0318054c4be1d7 |
| humanhash: | nevada-fix-comet-eight |
| File name: | Quotation #30 (CS fittings).exe |
| Download: | download sample |
| File size: | 1'663'488 bytes |
| First seen: | 2020-12-09 10:44:44 UTC |
| Last seen: | 2020-12-10 20:32:10 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 12288:ByeYoH5hOb3+QZRxmtxNPpQqIynUpsDYeGfnIxuk4x9L8Niov5:4gmyQZXmtx99I2UukeG/Gur2 |
| Threatray | 14 similar samples on MalwareBazaar |
| TLSH | 2F752242BE1191ABD2FCDE7AC86246F497F1F55110AEC4FDD2840A88EE3B4BC36D5185 |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: omanht.com
Sending IP: 185.222.57.177
From: Mujtaba Hassan <sales@omanht.com>
Subject: Quotation #30 (CS fittings)
Attachment: Quotation 30 CS fittings.r00 (contains "Quotation #30 (CS fittings).exe")
Intelligence
File Origin
# of uploads :
3
# of downloads :
104
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Quotation #30 (CS fittings).exe
Verdict:
No threats detected
Analysis date:
2020-12-09 11:22:07 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Signature
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Threat name:
Win32.Spyware.OutBreak
Status:
Suspicious
First seen:
2020-12-09 09:45:41 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
2/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 4 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8
MD5 hash:
a095b722591343954b0318054c4be1d7
SHA1 hash:
e36e612d24923129c9be88703d1544965836d72a
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.66
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe a3f7557658c2a4d37ae90e9f39acfe218959ffd9e6336860f659dd8eac0586e8
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.