MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 de1fc9c68764558d6a62d45d6b165f97f912edb095327274d41997e8b10d5541. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | de1fc9c68764558d6a62d45d6b165f97f912edb095327274d41997e8b10d5541 |
|---|---|
| SHA3-384 hash: | ec9e98829e833f227d5e8d8884dfc4417c241e5dbf6e67209b2102bed1b6d8580b6ad5052e1d0a8d68037b6cd53ad345 |
| SHA1 hash: | bc14646285ac9c0964d980c1d0138f0cbd01c00b |
| MD5 hash: | 3e8705370c9d62dd3bd1b4db16163b87 |
| humanhash: | william-don-blossom-bravo |
| File name: | Cotizaci�n RFQ.r00 |
| Download: | download sample |
| File size: | 461'975 bytes |
| First seen: | 2021-11-26 06:48:17 UTC |
| Last seen: | Never |
| File type: | r00 |
| MIME type: | application/x-rar |
| ssdeep | 12288:U3wWqrGDQZQQ0ptQ+7/zqYkmSkEDQYU73/H6355:U3YZQhu+/wQL+3X |
| TLSH | T1C5A42342F1C148B459D9FE1A62E6219B00423D97C9B54848836F370E76E7F9EEBB2CD1 |
| Reporter |  cocaman |
| Tags: | r00 |
cocaman
Malicious email (T1566.001)From: "=?UTF-8?B?VElFTkRBIFZBTFBBUkHDjVNPIExBRA==?= <valparaiso@sherwin.cl>" (likely spoofed)
Received: "from mx1.dreamhost.com (unknown [45.137.22.187]) "
Date: "25 Nov 2021 21:31:54 +0100"
Subject: "=?UTF-8?B?UmU6IENvdGl6YWNpw7NuIFJGUQ==?="
Attachment: "Cotizaci�n RFQ.r00"
Intelligence
File Origin
# of uploads :
1
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
obfuscated packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Threat name:
ByteCode-MSIL.Trojan.Tnega
Status:
Malicious
First seen:
2021-11-25 17:11:33 UTC
File Type:
Binary (Archive)
Extracted files:
19
AV detection:
21 of 44 (47.73%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
r00 de1fc9c68764558d6a62d45d6b165f97f912edb095327274d41997e8b10d5541
(this sample)
exe Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.