MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6551a360bd47e6bcc55f703d6baa108362e797a0753be5de335f28b611d199b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d6551a360bd47e6bcc55f703d6baa108362e797a0753be5de335f28b611d199b
SHA3-384 hash:	894b827f5a03e3d9924b27fbf606afdee1c0528ce835a00c4dd90daa925e3a533c621004887ca212033233f66207ff7c
SHA1 hash:	594ac6aa125f5c02f5bbb596279c337f43d778d2
MD5 hash:	74e3f12afc7fa54311e00f0786c1391f
humanhash:	ink-oscar-paris-fruit
File name:	New Purchase Order.PDF.z
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	650'809 bytes
First seen:	2024-09-09 02:49:52 UTC
Last seen:	2024-09-09 06:58:46 UTC
File type:	z
MIME type:	application/x-rar
ssdeep	12288:7wiN+OPeka8sQXKeIENvt1IsXevnABu0D+DLIjjJlqJiWBpKtCPTZ:7wKea/Ky7er0CDqHtWB1PTZ
TLSH	T1DDD433329D24D5F57D690051D602B6F9EE8F157CE94AAABCE0F7082762CC36134AB1B3
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	cocaman
Tags:	FormBook z

cocaman

Malicious email (T1566.001)
From: "Giorgi Namgaladze <g.namgaladze@rustavisteel.ge>" (likely spoofed)
Received: "from rustavisteel.ge (unknown [185.169.4.114]) "
Date: "8 Sep 2024 23:57:01 -0700"
Subject: "Inquiry"
Attachment: "New Purchase Order.PDF.z"

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

108

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	New Purchase Order.exe
File size:	693'248 bytes
SHA256 hash:	a1c124aa85ef07d4c39706dcd012d208576a4b08ec24106fd28d4c5847f9afc9
MD5 hash:	9ef9cffb40d3911e46cb798daa08b46f
MIME type:	application/x-dosexec
Signature	Formbook

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20240909-0636.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66de625c2b43a28a71757cd2

Tags:

Banker Encryption Execution Generic Network Msil Dexter

FileScan.io

Gathering data

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d6551a360bd47e6bcc55f703d6baa108362e797a0753be5de335f28b611d199b

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6551a360bd47e6bcc55f703d6baa108362e797a0753be5de335f28b611d199b/

ReversingLabs TitaniumCloud Win32.Trojan.Zmutzy

Threat name:

Win32.Trojan.Zmutzy

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-09-09 02:49:55 UTC

File Type:

Binary (Archive)

Extracted files:

7

AV detection:

13 of 38 (34.21%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2zkrunql2r7gxtcv64b5novbba3c46l2a5j34xpdgxziwyi5dgnq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/d6551a360bd47e6bcc55f703d6baa108362e797a0753be5de335f28b611d199b