MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d70323b4ee5178ca45caff34bea7742b6d7cdf80e515289551e41e5de87bdb7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d70323b4ee5178ca45caff34bea7742b6d7cdf80e515289551e41e5de87bdb7f
SHA3-384 hash: 09f93634b262944b05468f769495f71177f67fef39cfe3b7e701d05c38c34272f8d12789b082b91b13d37e6c6e228932
SHA1 hash: 6c867984d10f6dfab3ed4659f3d613fa4e7343c6
MD5 hash: af99f064949e31994dbc027b01156708
humanhash: foxtrot-alanine-alaska-september
File name:05182000_00005.PDF.z
Download: download sample
Signature HawkEye
Create hunting rule
File size:582'525 bytes
First seen:2020-05-18 09:07:29 UTC
Last seen:Never
File type: z
MIME type:application/gzip
ssdeep 12288:3+cUcwvwTX9Us0wg0rcm10dcKHMknsebTUM7HRdZeyYbc2ezaqE:uzYTX95E0Qm1wNMXefPtdYyYbcVaP
TLSH BBC4234BA57DAD05D7C72102B0F08521827889D47DBDED272A1B71BA3C5A0FC9E37A1E
Reporter abuse_ch
Tags:HawkEye z


Avatar
abuse_ch
Malspam distributing HawkEye:

From: Jenny Cho LF Sourcing <lfsourcing@naver.kr>
Subject: Re: New fabric design and color for order recap development
Attachment: 05182000_00005.PDF.z (contains "gunzipped")

HawkEye FTP exfil server:
ftp.triplelink.co.th:21

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.CookieTools.13993.13725.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-18 09:36:21 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=24bshnhokf4murok742l5j3ufnwxzx4a4uksrfkr4qpf32d33n7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

z d70323b4ee5178ca45caff34bea7742b6d7cdf80e515289551e41e5de87bdb7f

(this sample)

HawkEye

Executable exe a46a4d49d8497c6cf8560c708fc6cf68c6901f2762938caa3be46b47a62d3ea6

  
Dropping
MD5 093852c05607d0195e73a135b1c48df2
  
Dropping
HawkEye
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a46a4d49d8497c6cf8560c708fc6cf68c6901f2762938caa3be46b47a62d3ea6

Comments