MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e586364d2f3a4cda35c4b5a80a2650a719f0358f08853be35cdc467580a94ff1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e586364d2f3a4cda35c4b5a80a2650a719f0358f08853be35cdc467580a94ff1
SHA3-384 hash:	2bf6a12d16f7f4e4f130a0bc690d5c3f697787fbd7573e115f66e3b5b5fe85c9478da206285586f936f6987d7f87c857
SHA1 hash:	43aff8a2fe9e809ed22fadba74b3a7a816e8c71f
MD5 hash:	f1f09a45cf1d5bebaac7d3c44821bbf1
humanhash:	nine-earth-apart-ceiling
File name:	【PI202211385】in US dollars.pdf.arj
Download:	download sample
Signature	AgentTesla Alert Create hunting rule
File size:	613'786 bytes
First seen:	2023-12-18 10:53:07 UTC
Last seen:	Never
File type:	arj
MIME type:	application/x-rar
ssdeep	12288:ON7Nx4eGaPqkJRpgxVw//Guz/gPwHkfGMVAEZVH1eM74MvU:ONz4eNfRpg7w//GuDgQKG8bZVVfEMvU
TLSH	T12CD4231B74947AC417029B8A3D28FB2FA1DA0742D750F88D2064757722AFE3F229DF65
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla arj INVOICE

cocaman

Malicious email (T1566.001)
From: "Rashid Jabbar <accounts@tunacelikkapi.com>" (likely spoofed)
Received: "from tunacelikkapi.com (unknown [185.222.58.103]) "
Date: "18 Dec 2023 08:44:39 +0100"
Subject: "Re: Proforma invoice"
Attachment: "【PI202211385】in US dollars.pdf.arj"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

105

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	【PI202211385】in US dollars.pdf.exe
File size:	859'136 bytes
SHA256 hash:	abd4a743c4aa8fb625f1af14edc51606fc1b8e1a15396d9db706c1fd3cf41395
MD5 hash:	bfbfbe3d395b944474c79432ef47b433
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.28929.RarHeur.UNOFFICIAL

Alert

Create hunting rule

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e586364d2f3a4cda35c4b5a80a2650a719f0358f08853be35cdc467580a94ff1/

ReversingLabs TitaniumCloud Win32.Trojan.AgentTesla

Threat name:

Win32.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-18 07:54:29 UTC

File Type:

Binary (Archive)

Extracted files:

9

AV detection:

19 of 37 (51.35%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4wddmtjphjgnunoewwuaujsqu4m7anmpbcctxy243rdhlafjj7yq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.97

Link:

https://yomi.yoroi.company/submissions/e586364d2f3a4cda35c4b5a80a2650a719f0358f08853be35cdc467580a94ff1