MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d964dfb42f273a20b8ed61a7a85cd7e12a0df8deaed1653efe2b67325a00a59d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 12 File information Comments

SHA256 hash:	d964dfb42f273a20b8ed61a7a85cd7e12a0df8deaed1653efe2b67325a00a59d
SHA3-384 hash:	14e9695858822b1f49f874aac984b5ec70241b05002dd62592113752ffef1d4eea1dd62bb0109f85f6c49aca8abe6b4f
SHA1 hash:	ef8aa3f192cd5f8143337fabc9dbcc0ad306bdc7
MD5 hash:	b365fbd4fbdfcbe79b182cb346d3472c
humanhash:	shade-fruit-charlie-twelve
File name:	SHIPPING DOCUMENT.iso
Download:	download sample
File size:	1'271'808 bytes
First seen:	2024-12-11 17:28:56 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	24576:JwgLute1OpMwIaBZfj45/XjciS55uuMdnhbWgM:SNCwIaBVUhTZ15hb5M
TLSH	T16C45121436EAC727F5FBABBDA4A161028B3B7446D467CFA82C9C60C90563B044953F7B
TrID	88.5% (.NULL) null bytes (2048000/1) 11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.1% (.ISO) ISO 9660 CD image (2545/36/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika	iso
Reporter	cocaman
Tags:	iso Shipping

cocaman

Malicious email (T1566.001)
From: ""bankucb1.com" <info@bankucb1.com>" (likely spoofed)
Received: "from [154.216.17.25] (unknown [154.216.17.25]) "
Date: "11 Dec 2024 06:59:37 -0800"
Subject: "Fw: NEW SHIPMENT FOR OUR CUSTOMER"
Attachment: "SHIPPING DOCUMENT.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	SHIPPING DOCUMENT.exe
File size:	1'220'608 bytes
SHA256 hash:	42032b95c64841b1c70836ce5541cb668f96b5a5227e7f04bf9abe92b4880333
MD5 hash:	2d4af8e75279ce94b48910e2cec09ccd
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_fs3328.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6759ce617767f0db2ec706ab

Tags:

virus micro

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

context-iso masquerade packed packed packer_detected

Link:

https://www.filescan.io/uploads/6759cbdf4730808d62bd9b75/reports/c8b4cdde-f5e8-467d-9023-e1438951e432/overview

Verdict:

Suspicious

Labled as:

Mal/DrodIso

Link:

https://www.hybrid-analysis.com/sample/d964dfb42f273a20b8ed61a7a85cd7e12a0df8deaed1653efe2b67325a00a59d

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d964dfb42f273a20b8ed61a7a85cd7e12a0df8deaed1653efe2b67325a00a59d/

Threat name:

Win32.Trojan.Znyonm

Status:

Malicious

First seen:

2024-12-11 08:22:37 UTC

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3fsn7nbpe45cbohnmgt2qxgx4eva36g6v3iwkpx6fnttewqauwoq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d964dfb42f273a20b8ed61a7a85cd7e12a0df8deaed1653efe2b67325a00a59d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)