MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5cfda16e7e48ff35a90bd7b052d3980ea01ac0074907bb7ae5fe9a5859590d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5cfda16e7e48ff35a90bd7b052d3980ea01ac0074907bb7ae5fe9a5859590d6
SHA3-384 hash: 7762dc150b98ee3ddf60b1b9233d5226c055cae64a788ff03c99529ac0eb7eb51826b27072c5059c650ba0d898cc57a2
SHA1 hash: 72d0fa5ab60b9534ab087aac236548706b607ac9
MD5 hash: 61575f5e382fec8771106e231b32655a
humanhash: sixteen-nitrogen-kansas-venus
File name:New Enquiry Order#SJM67885____PDF.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-04-28 05:58:43 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:xRlSQzwvarKqs/WpwAkzscdDRrVihzwa6CDn+l1ze9lwp1kp/C73dNy:xTSxarK1/Wnk4c9Ro6a6Eke9ls0Y
TLSH 36451554BFF858E3C26A5CF50071103047B19F2665BBE2D66C8671FA16F1BEB0A93A43
Reporter cocaman
Tags:img NanoCore


Avatar
cocaman
Malicious email
From: "Sophie Cheng" <purchase@unifiedtrades.com>
Received: from Kast-4vcpu-8gb-ams3-01.local (unknown [167.172.61.15])
Date: 27 Apr 2020 20:53:40 -0700
Subject: =?UTF-8?B?S2luZCBBdHRuOiDntKfmgKUgTmV3IEVucXVpcnkgT3JkZXIjU0pNNjc4ODU=?=
Attachment: New Enquiry Order#SJM67885____PDF.img

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Nymeria-7168557-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-04-28 04:14:39 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxh5ufxh4sh7gwuqxv5qkljzqdvadlaaosihxn5ol7u2lbmvsdla._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img b5cfda16e7e48ff35a90bd7b052d3980ea01ac0074907bb7ae5fe9a5859590d6

(this sample)

NanoCore

Executable exe d2dbd686e32057f85bd87cd34af193f3ebf6e6f99de996da2a8dcc533d9ad19f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d2dbd686e32057f85bd87cd34af193f3ebf6e6f99de996da2a8dcc533d9ad19f

Comments