MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc5af652808a7a41406b22f148a9e6bb8f45bbad9e2b8e13679d6c545c00b63a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc5af652808a7a41406b22f148a9e6bb8f45bbad9e2b8e13679d6c545c00b63a
SHA3-384 hash:	3cb5750e56bd36bbee542cae58303c278e1b31be74806df1faa4343c40a1e1f76f2a5b2781f4cfc29fa0694d700b1819
SHA1 hash:	cc83b0374801f7f1868ffb992e1a04c7812195e8
MD5 hash:	846dbf899645abb88a61103170dd6c5f
humanhash:	kitten-fillet-white-batman
File name:	1 Total New Invoices - Wednesday May 17 2023_1062.js
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	60'286 bytes
First seen:	2023-05-19 01:45:55 UTC
Last seen:	2023-05-31 10:33:48 UTC
File type:	js
MIME type:	text/plain
ssdeep	1536:e5T+JD5U4Yi3iDxlOJQfuvlHY6/6DekJlLy41xqdvFJ1T9pQ:E2UQ0o46/6De4Pez9+
TLSH	T1BA4363D62BFAFE56516712B33796C2A5F4198C81C6D89CCDF6407C64F4AC600BBB848E
Reporter	JAMESWT_WT
Tags:	Gozi js vipbeed-com

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

313

Origin country :

IT

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

hyena virus

Link:

https://www.filescan.io/uploads/6466d4de75f687672ac71cb1/reports/bdaeb5b7-56d0-45b5-b1b6-fe6532b321c8/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/bc5af652808a7a41406b22f148a9e6bb8f45bbad9e2b8e13679d6c545c00b63a

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1236633

Signature

JavaScript source code contains functionality to generate code involving HTTP requests or file downloads

JScript performs obfuscated calls to suspicious functions

Sample has a suspicious name (potential lure to open the executable)

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc5af652808a7a41406b22f148a9e6bb8f45bbad9e2b8e13679d6c545c00b63a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xrnpmuuarj5ecqdlelyurkpgxohulo5ntyvy4e3htvwfixaawy5a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230519-b6y4ysee32/

Behaviour

Script User-Agent

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.68

Link:

https://yomi.yoroi.company/submissions/bc5af652808a7a41406b22f148a9e6bb8f45bbad9e2b8e13679d6c545c00b63a