MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480
SHA3-384 hash: 19ab15a873889494ab6d4ae40b8640c0c5759a8fd5c68a60a603b5092b46561854423c66020173e448c59476bbcc76d4
SHA1 hash: caa06d7da465a19e8d2d9b140109eb86c04a4010
MD5 hash: fb8eacb936940d255e856bbe8dfba277
humanhash: india-maine-kansas-five
File name:emotet-js-downloader.zip
Download: download sample
File size:277'897 bytes
First seen:2020-04-14 12:02:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+YPing3qeF0VXI3gor67qvmG4AfvkXkjddEUYJCOb:+YPiuqeF05IPvJWdb
TLSH EA44232221AB6BF1723D4BFE71CD267D99AC3ED94CF91963B59308E514FB0069E01983
Reporter Libranalysis
Tags:deobfuscation Downloader Emotet javascript


Avatar
Libranalysis
A detailed analysis of the JavaScript downloaded can be found here: https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-javascript-downloader/

Intelligence

File Origin
# of uploads :
1
# of downloads :
223
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Doc.Trojan.Emotet-7171821-0
Create hunting rule

Doc.Downloader.Emotet-7173379-0
Create hunting rule

Doc.Dropper.Agent-7172382-0
Create hunting rule

SecuriteInfo.com.JS.Obfus-1069.UNOFFICIAL
Create hunting rule

Js.Downloader.Emotet-6954534-0
Create hunting rule

Gathering data
Threat name:
Document-Word.Trojan.Sdrop
Create hunting rule
Status:
Malicious
First seen:
2020-04-14 12:35:19 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments