MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67
SHA3-384 hash:	d7ca3cfd7f77a92e3793b37a53444e3b6b06fe44ac28a1d4154550a238dab495002200543710714cf7f2cd3739d95307
SHA1 hash:	5b46e3d111b85ff0e5daf8fa6eec820dc201d334
MD5 hash:	c85e6efcbe2fff66ba750ad9a1591789
humanhash:	high-lima-finch-iowa
File name:	1_202306214896082421.zip
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	21'895 bytes
First seen:	2023-06-21 08:30:58 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	384:TU9m2lB2E95czsDV1qCH5L5WC+9ON48MTAgurrgCvO+x0:TYfH/cu1q+Z8EF1r0Yzx0
TLSH	T194A2D081C7F98590D228F25B07FEB101276DC1812086D3284ADBE3EDF997A3D5E69F40
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	agenziaentrate balkun-com Gozi ITA Ursnif zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

176

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	1_202306214896082421.js
File size:	47'003 bytes
SHA256 hash:	838b6968c6034ece8d77962513bb12c8f597670a12a56e6abde979b65ab6179d
MD5 hash:	c6beee92f536c817314fd7e5499196f1
MIME type:	text/plain
Signature	Gozi

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Zip_1.UNOFFICIAL

Alert

Create hunting rule

PUA.SecuriteInfo.com.JS.Malware-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

JS File

Link:

https://app.docguard.net/d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67/results/dashboard

Payload URLs

URL

File name

https://dnt-dashboard.mozilla.org

JS File

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

nemucod obfuscated sload virus

Link:

https://www.filescan.io/uploads/6492b54a99f0c0cb09332c8b/reports/75deb518-8f54-4a26-b9e5-e732745f0741/overview

Hybrid Analysis HEUR/Suspar.Generic

Verdict:

Malicious

Labled as:

HEUR/Suspar.Generic

Link:

https://www.hybrid-analysis.com/sample/d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67/

ReversingLabs TitaniumCloud Binary.Malware.Generic

Threat name:

Binary.Malware.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2023-06-21 07:34:44 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

3 of 36 (8.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2nou2ymmjsdltzgr7pkhpwj66mk47mew6niljlqqefibwqjxbvtq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/230621-km5xtshe8x/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d35d4d618c4c86b9e4d1fbd477d93ef315cfb096f350b4ae1021501b41370d67