MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a952f0a50a0009bac81edec33191d32282ae881ac1464b749dba2b1b3912cdc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a952f0a50a0009bac81edec33191d32282ae881ac1464b749dba2b1b3912cdc4
SHA3-384 hash: f447d932e80e24580512e7c99805479ec11c05660c5fdc6ed63347cfb4c49a4827b675075972172072c0df30c63535ee
SHA1 hash: 1501ed304ab29a27a8b2af14a6e12d3158d8080f
MD5 hash: 1aa1ad082c55d92976a49a0a78cd03a4
humanhash: blossom-nevada-apart-double
File name:Descrição da oferta do produto 873564635640rden2020.arj
Download: download sample
File size:28'558 bytes
First seen:2020-10-14 14:30:15 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:4muEYUkpaClQSkoZBlioKcF2QKHt+mqSzI4wU2nvz9BZ/oqRnyaXr8CoHSpGsvR:41UDSkAiQKNpqS4Jzoq1YDypD
TLSH 47D2E171B4EBDAF0F32C83DC5131A046255A2492AC4593F0B3D1B3E49DC8D98F6A76D6
Reporter abuse_ch
Tags:arj geo PRT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: geral@cm-arruda.pt
Subject: Cotação de preço
Attachment: Descrição da oferta do produto 873564635640rden2020.arj (contains "Descrição da oferta do produto 873564635640rden2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a952f0a50a0009bac81edec33191d32282ae881ac1464b749dba2b1b3912cdc4/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-13 19:30:20 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfjpbjikaae3vsa633btdeotekbk5ca2yfdew5e5xivrwoiszxca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a952f0a50a0009bac81edec33191d32282ae881ac1464b749dba2b1b3912cdc4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

arj a952f0a50a0009bac81edec33191d32282ae881ac1464b749dba2b1b3912cdc4

(this sample)

Executable exe 5b8359668a34cfe71ccad1e1864a36c27a2174bd3ffe39216ae0e5e04031c1c1

  
Dropping
MD5 84d95cbd4b14ae39f2a931c3a1e2d897
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b8359668a34cfe71ccad1e1864a36c27a2174bd3ffe39216ae0e5e04031c1c1

Comments