MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480
SHA3-384 hash: 19ab15a873889494ab6d4ae40b8640c0c5759a8fd5c68a60a603b5092b46561854423c66020173e448c59476bbcc76d4
SHA1 hash: caa06d7da465a19e8d2d9b140109eb86c04a4010
MD5 hash: fb8eacb936940d255e856bbe8dfba277
humanhash: india-maine-kansas-five
File name:emotet-js-downloader.zip
Download: download sample
Signature n/a
File size:277'897 bytes
First seen:2020-04-14 12:02:54 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+YPing3qeF0VXI3gor67qvmG4AfvkXkjddEUYJCOb:+YPiuqeF05IPvJWdb
TLSH EA44232221AB6BF1723D4BFE71CD267D99AC3ED94CF91963B59308E514FB0069E01983
Reporter @Libranalysis
Tags:deobfuscation Downloader Emotet javascript


Twitter
@Libranalysis
A detailed analysis of the JavaScript downloaded can be found here: https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-javascript-downloader/

Intelligence


File Origin
# of uploads :
1
# of downloads :
144
Origin country :
NL NL
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Document-Word.Trojan.Sdrop
Status:
Malicious
First seen:
2020-04-14 12:35:19 UTC
File Type:
Binary (Archive)
Extracted files:
40
AV detection:
20 of 31 (64.52%)
Threat level:
  2/5

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

zip ddfedf6178d86d3372922620116d8c973e0627b5ac1ef087cc7c15cfcc452480

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments