MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095
SHA3-384 hash: 54977d27f8555969bd2ca6a645fc98f2faadaaf031504d53fdce5acbb315f2aab962d8cd21f0d0c69b8a3dcadab2f450
SHA1 hash: c139a4b7ee33c011b7acfd39aa5fee1f403d11ac
MD5 hash: a11bdece30dea9b1d170f6c06f5c436d
humanhash: california-equal-east-march
File name:SOA.zip
Download: download sample
File size:107'393 bytes
First seen:2022-04-16 06:37:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:dIp/wCj1x8ttZwBsCv7IsrLRlpwWB33VA1uwKkjhHbu9fqppJz6gzu194aQ:gvEGaM7xeWpFA1uwKmsfapJ7zu1LQ
TLSH T144A312153D0A2811AB22EE3772E4B9E3DF46590DCA988178F6B8EC47D28D875D2DC50F
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "John Emar De Guzman <nurse@mapecon.com.ph>" (likely spoofed)
Received: "from mapecon.com.ph (unknown [103.171.0.38]) "
Date: "14 Apr 2022 08:10:53 -0700"
Subject: "Statement of Account : MEDICARD"
Attachment: "SOA.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
401
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1292.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-2146.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.27269.JsHeur.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/625a644b482f2f41caba7897/reports/f82da0a7-2ca1-4a20-9285-1113fea80e65/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-04-14 16:34:19 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
4 of 42 (9.52%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vij7atqve7i7uizjwcpz3niniagbmcgw5ph245qb3vpsfuvv2ckq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip aa13f04e1527d1fa2329b09f9db50d400c1608d6ebcfae7601dd5f22d2b5d095

(this sample)

unknown 871d04499245db9419997fee7dee54ba8b001efebebffe9eb6c31bffa68cdd02

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 871d04499245db9419997fee7dee54ba8b001efebebffe9eb6c31bffa68cdd02
  
Dropping
SHA256 790bdf717f69e1060209731bd2d87f49f816f4bdaf4e955c93bed13d6870a22e

Comments