MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd90fc7381f7aae575055bc47d40782df4dc2f750cad93a6471dd61f6e6366c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd90fc7381f7aae575055bc47d40782df4dc2f750cad93a6471dd61f6e6366c1
SHA3-384 hash: caa6c198a69c0922ff34b88ea8b1cdc324440d4bf1e7cd2f6d81ba8cb8636960d51b3ff66f483187f1ea64dd562812ab
SHA1 hash: a1817a55d5f11d637dbb51dca511a4970e09e16a
MD5 hash: 9aeb8b12296fa2aced8bc957c6c67c9c
humanhash: xray-may-undress-echo
File name:purchase order.zip
Download: download sample
File size:488'977 bytes
First seen:2020-08-18 13:18:47 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:v+OL6h6VUp9ZIbVCXsfs2Db021N2q6c3bkD7/shnXrV6qsGe57Nf+xWwsyiwowzo:vJ47cDb02n2cb87y53zACIyiwoUx+W0D
TLSH CBA4239864C16307BC4D0936CDCBF2B2B4AE8C09A6AD3568A1C3BA7F57C3D5A5049D37
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mx.yiqioachina.com
Sending IP: 64.227.86.17
From: jum@yiqioachina.com
Subject: Re : Purchase Order
Attachment: purchase order.zip (contains "purchase order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.20909.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd90fc7381f7aae575055bc47d40782df4dc2f750cad93a6471dd61f6e6366c1/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 13:20:12 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wipy44b66vok5iflpch2qdyfx2nyl3vbswzhjshdxlb63tdm3aq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd90fc7381f7aae575055bc47d40782df4dc2f750cad93a6471dd61f6e6366c1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip dd90fc7381f7aae575055bc47d40782df4dc2f750cad93a6471dd61f6e6366c1

(this sample)

Executable exe 3342139f47df082fc20b738eec263c9d4469bfa0d00677c0eb9cf2703aaf9564

  
Dropping
MD5 8610ef93a81e9ec871e558346d22709a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3342139f47df082fc20b738eec263c9d4469bfa0d00677c0eb9cf2703aaf9564

Comments