MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf91d27699c9c8ace0175f6445e078ed22ff8d2474470fa004d52ce6efa0568a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf91d27699c9c8ace0175f6445e078ed22ff8d2474470fa004d52ce6efa0568a
SHA3-384 hash:	5fe7f35d4997f8263b7981437b13e64ff427fa4b6ea6965ebf4753847878a0d981fcbcbd25deca339848be6c495dbcbe
SHA1 hash:	d590f1d42b3961e0767de3bb02014c41d4b0b184
MD5 hash:	7695ab15d0cc101c36c795430ea30fa3
humanhash:	solar-yankee-uranus-mexico
File name:	AISZ2467_3568557.zip
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	366'184 bytes
First seen:	2023-10-11 23:14:24 UTC
Last seen:	2023-10-11 23:29:19 UTC
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: W1289
ssdeep	6144:2dcjrKNpuS9olryq2wBs1UKgKAY5gcScNaOnUiK5jQUF3kN2izYHlbC/:2dkS9olF2wBs1UZGNaZiKx/FQYHlG/
TLSH	T192742315C8A2CE9CC9372F71E51E9A07B1DDC3EDF14877AFBA6D4A80D1A74894322624
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	gestionhqse-com IcedID p-W1289 pw-W1289 zip

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

153

Origin country :

IT

File Archive Information

This file is a password protected archive. The password is: W1289

This file archive contains 2 file(s), sorted by their relevance:

Relevant files 2

File name:	readme[2023.10.11_08-07].txt
File size:	176 bytes
SHA256 hash:	9a2805f14b4b13ec6e5e301f16c4202bee39db29942c5d9125385292bcb9b24b
MD5 hash:	00f0a0fe1f1f47c733b962e789810ab4
MIME type:	text/plain
Signature	IcedID

File name:	New_Working_Conditions[2023.10.11_08-07].vbs
File size:	1'037'251 bytes
SHA256 hash:	c3cfabfe54884ee0bf1d2f990571c5accee775e1d76f28c1b891893ad2e2382e
MD5 hash:	d6d24944526a4d2e37da13b71ea72e7d
MIME type:	text/plain
Signature	IcedID

Vendor Threat Intelligence

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cf91d27699c9c8ace0175f6445e078ed22ff8d2474470fa004d52ce6efa0568a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf91d27699c9c8ace0175f6445e078ed22ff8d2474470fa004d52ce6efa0568a/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z6i5e5uzzhekzyaxl5selydy5urp7djeordq7iae2uwon35ak2fa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.