MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf7d78ccf498af8f507bd7fd60b0154ca5b1170ba29e84cd42a74ec91069b1d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf7d78ccf498af8f507bd7fd60b0154ca5b1170ba29e84cd42a74ec91069b1d7
SHA3-384 hash: e85829239ac73b735bbcb0ea33a820251a5502efe0cdb81b40df806ff4ae9763ea755b1434aead408b2d6f53de2cb50d
SHA1 hash: 19214ed1a1d067967f57835840bfdeee6c6a084e
MD5 hash: c09af984c58cd23baf17e6b1fd2cd43f
humanhash: edward-mexico-louisiana-louisiana
File name:Descrição da oferta do produto 873564635640rden2020.arj
Download: download sample
File size:23'059 bytes
First seen:2020-10-14 14:31:18 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 384:qH9Kfvc/VhhXkbvFNS3esoVXF1KH4pXi1RRjfacKdXxWJiXcP6Y2NeIRaX+LH1H:q4fvc/D121soVX/XpXFcKR3Mt2NeIbLh
TLSH 56A2E0BDEE78E909D43396F6EA0A570A438620DA30670DD97793DCDACF8C6003D30886
Reporter abuse_ch
Tags:arj geo PRT


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: h22.megalink.com
Sending IP: 200.75.160.22
From: geral@cm-arruda.pt
Subject: Cotação de preço
Attachment: Descrição da oferta do produto 873564635640rden2020.arj (contains "Descrição da oferta do produto 873564635640rden2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf7d78ccf498af8f507bd7fd60b0154ca5b1170ba29e84cd42a74ec91069b1d7/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 17:34:49 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x56xrthutcxy6ud3276wbmavjss3cfylukpijtkcu5hmsedjwhlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bf7d78ccf498af8f507bd7fd60b0154ca5b1170ba29e84cd42a74ec91069b1d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

arj bf7d78ccf498af8f507bd7fd60b0154ca5b1170ba29e84cd42a74ec91069b1d7

(this sample)

Executable exe be668820f01ddc624a59e45556ee918ac38991b437c675d4c67be6cdcfc23553

  
Dropping
MD5 87fe008bc303d081292126557f63d23e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be668820f01ddc624a59e45556ee918ac38991b437c675d4c67be6cdcfc23553

Comments