MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bddb31cdd02276c13d03539e4d0bfc8da13dc6bccd18014a895c145cfb77b356. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bddb31cdd02276c13d03539e4d0bfc8da13dc6bccd18014a895c145cfb77b356
SHA3-384 hash:	6923783d8f3af4804bcfd2570bbd2d6bdefcb42368c4153218c3d189a18fbf30a2f56c4d94318a44e49e7ad1e48c8585
SHA1 hash:	343b6ac60a487985b08186a052c5918904a2de75
MD5 hash:	965209f5b7bde1d55de9c5ef4300f52e
humanhash:	three-shade-leopard-white
File name:	redacted document 11.16.2022.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	468'313 bytes
First seen:	2022-11-16 20:16:18 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 161122
ssdeep	12288:h4dIQ9pfW3LwqWj0/FSpZnj0tdukK0usDFdZk:hifM0uFsUXBusO
TLSH	T152A423D1F6C2F4CC651A7DDE20AF9C46D76CE90E590DA321C8A47C7388C2D196B6ACC6
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	k3dg3___
Tags:	1626240797 IcedID pw 161122 TA551 zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

258

Origin country :

US

File Archive Information

This file is a password protected archive. The password is: 161122

This file archive contains 3 file(s), sorted by their relevance:

Relevant files 3

File name:	solve.cmd
File size:	676 bytes
SHA256 hash:	8fc0d50f6aa791a56f67fecc5251125331e458e31fdda29e0fb3d74a90cf7f2f
MD5 hash:	ac53a3c8e71e41f1f4427a20af9e164a
MIME type:	text/plain
Signature	IcedID

File name:	gentle_box.png
File size:	97'792 bytes
SHA256 hash:	70b22930552f93437ffaa884c630c1869c025526bb24d0b950bcd556a464a57d
MD5 hash:	9cfdb19ac2c7c7399bf6b3ff7b7c6cde
MIME type:	application/x-dosexec
Signature	IcedID

File name:	document-02979.chm
File size:	399'548 bytes
SHA256 hash:	0aaab3ec1d94d0370e4b2ff594bcfc15d0565fafcc03ed3b4940fadad09a761d
MD5 hash:	b532f2edc669d064b22374b26a3cb711
MIME type:	application/octet-stream
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bddb31cdd02276c13d03539e4d0bfc8da13dc6bccd18014a895c145cfb77b356/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xxntdtoqej3mcpidkope2c74rwqt3rv4zumacsujlqkfz63xwnla._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI IcedID

Threat name:

IcedID

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/bddb31cdd02276c13d03539e4d0bfc8da13dc6bccd18014a895c145cfb77b356