MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1aca8563d86480f3a7495c06c0dc36ff1de884584fe087fc21c1797d66ff21c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1aca8563d86480f3a7495c06c0dc36ff1de884584fe087fc21c1797d66ff21c
SHA3-384 hash: 1494d05a92e0689346da5a82de439755bf3c1f468c560fa30365d095a868eb92b3f9ce2907aeaadb6e56e09d3c5453e0
SHA1 hash: a6ed12dff98e4f9d1f2e8c343d56fcf0e45305e0
MD5 hash: 5b4f3bc6c25cebec3e825f33abffe41f
humanhash: freddie-summer-violet-arkansas
File name:Transfer Forms.img
Download: download sample
File size:1'245'184 bytes
First seen:2020-12-22 12:49:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:CG82E3AMU7WjM5xJ2+zyY+Fz6hTQcVtxsURHmGhkm:M2oAMUFxJ2+zichTdw4fP
TLSH 5145E1D1B20CE8AEE92961F24967C5609851BD5A8371C19B348FF31E5AB3303596FE0F
Reporter abuse_ch
Tags:Endurance img


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: 162-144-100-85.unifiedlayer.com
Sending IP: 162.144.38.36
From: PAY-U INT'L <sales9@oxy99.in>
Subject: INCORRECT BANK DETAILS FOR PAYMENT
Attachment: Transfer Forms.img (contains "Transfer Forms.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.14444.16120.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1aca8563d86480f3a7495c06c0dc36ff1de884584fe087fc21c1797d66ff21c/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2020-12-22 12:50:09 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4gwkqvr5qzea6otusxagydodn7y55ccfqt7aq76cdqlzpvtp6ioa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.50
Link:
https://yomi.yoroi.company/submissions/e1aca8563d86480f3a7495c06c0dc36ff1de884584fe087fc21c1797d66ff21c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

img e1aca8563d86480f3a7495c06c0dc36ff1de884584fe087fc21c1797d66ff21c

(this sample)

Executable exe d0a531def227f88eb7cf052fb7b94b33b7a1daca060bdb464e21739d606c99d4

  
Dropping
MD5 6ea1db915fd8fd673e08143a6607987b
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d0a531def227f88eb7cf052fb7b94b33b7a1daca060bdb464e21739d606c99d4

Comments