MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe
SHA3-384 hash:	6c8374bb8d415a7a2692d3b7b7b0edb75f4ac2ab038ea1b12d32af8606cc64fed14bffad7dd9a32450cc8f2787a14c62
SHA1 hash:	0f8c2a961fb959eefd3fd3c9de7a1782d3e609f5
MD5 hash:	1b988ad9e3a6b8b8cbfeb3d7cf30beeb
humanhash:	twenty-princess-vegan-chicken
File name:	EXCEL_DOCUMENT_OPEN.vbs
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	32'876 bytes
First seen:	2024-04-12 09:43:45 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:MkHOEbpcMYjmv1rxc5KTPBoMqS7j8frPWgtZPnCUQpBNgZnFFQE/0FRIpaN1hXQQ:xOo0Wxc5KTPBoMqS7j8frPWgtZPnCUQH
TLSH	T16BE260593C4761660A37F27AAB7BB549FB75802B2201A140B85D836C2F70E5052BDEDE
Reporter	proxylife
Tags:	DarkGate vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

204

Origin country :

US

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Link:

https://www.filescan.io/uploads/6619026408ebdfcacd020916/reports/11a68957-7736-4e57-ad09-84d2afa374fd/overview

Hybrid Analysis SVM:TrojanDownloader/JS.Nemucod

Verdict:

Suspicious

Labled as:

SVM:TrojanDownloader/JS.Nemucod

Link:

https://www.hybrid-analysis.com/sample/cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1425007

Signature

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zwgxbzfbsgdidsf5qhbthn7s6j2dhoxu3zsawuxfek76vagabl7a._file

Threatray unknown

Verdict:

unknown

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/240412-lqgj3shc94/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.74

Link:

https://yomi.yoroi.company/submissions/cd8d70e4a1918681c8bd81c333b7f2f27433baf4de640b52e522bfea80c00afe