MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d
SHA3-384 hash:	cae16bc715c5a7203a3dae034b663bafb026378344c9905eace8b0d0e982dd6d037be12b4e1f110253562a3adae4f37c
SHA1 hash:	fc36d1d8b895e73d3f0dd6b46ad3ad99816c3e6a
MD5 hash:	9d8342d010a81b7cb2e0bbafa90d9c24
humanhash:	summer-oklahoma-muppet-fanta
File name:	SOA.zip
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	781'422 bytes
First seen:	2024-09-10 07:59:18 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:TxgJyiQ/daFy8wZxuOE5W+6h1AOfRItGs7Yiaa/8ttyQIZ+c50ztLLtlzeuni:T2Jy7aF8ZxuOE5gh1AOfURFp8WQS+DtA
TLSH	T1A2F42396D61DB8B7F2B868741102C0F3CBE61165678FCE588E4EC88DCAE51EA43425DF
Magika	zip
Reporter	cocaman
Tags:	Shipping zip

cocaman

Malicious email (T1566.001)
From: ""Navas Shareef - SSA" <navas@sharafshipping.com>" (likely spoofed)
Received: "from sharafshipping.com (unknown [141.98.10.21]) "
Date: "10 Sep 2024 09:58:36 +0200"
Subject: "RE: RE: SOA"
Attachment: "SOA.zip"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

588

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	SOA.exe
File size:	1'219'584 bytes
SHA256 hash:	b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7
MD5 hash:	a5c3c7bc08be513832d1f5eb9f4a76c0
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs3367.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66dffc8576bc4542b0495219

Tags:

Inject

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d/results/dashboard

Behaviour

BlacklistAPI detected

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z2yn3s3ftwy7oihpue7jcpud35oxhpzhp4w5vk6dybdlqjowefwq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Formbook

Threat name:

Formbook

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ceb0ddcb659db1f720efa13e913e83df5d73bf277f2ddaabc3c046b825d6216d