🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edfa8e2ca123daba68227a2f6fc8a3a84710bd016f5104baf89490cbc49c265a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


IcedID


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edfa8e2ca123daba68227a2f6fc8a3a84710bd016f5104baf89490cbc49c265a
SHA3-384 hash: a9e39f8a1c09a5b3ccc7f2320114e5a8c621df12c60d5ce0ca77766c69a5f8e0687d00b4032bcb1cf8ea8828683f25f0
SHA1 hash: 3272dc8cba8d204d86670e024a19c77593ee34b0
MD5 hash: 945e33126c533c343a4f410881c1cee6
humanhash: grey-princess-johnny-beer
File name:redacted-invoice-10.19.2022.html
Download: download sample
Signature IcedID
Create hunting rule
File size:1'476'909 bytes
First seen:2022-10-19 15:09:23 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 24576:BEDcX+0WZZxM52FvkA/Jdves9A7mD3KkyenVKEVFJpoCll0P:NSZkuR6RWrVf2rP
TLSH T1346533911FC6F9BE032C2A55643B1E0C298004D1448DDEE7E3D7E1C76B6FEAA8897895
TrID 62.5% (.SMI/SMIL) Synchronized Multimedia Integration Language (5001/2/2)
37.4% (.HTML) HyperText Markup Language (3000/1/1)
Reporter k3dg3___
Tags:56237520 html IcedID pw g3EpYzqk TA551

Intelligence

File Origin
# of uploads :
1
# of downloads :
264
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.26626.SvgHeur.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.JS.Obfus-2179.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M1.20220427.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M3.20220427.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6350134b4fc319a52d56305e/reports/719b487a-e7e2-45d1-bfe7-7b8227d99dcb/overview
Result
Threat name:
HtmlDropper
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1093593
Signature
HTML document with suspicious name
Yara detected Html Dropper
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edfa8e2ca123daba68227a2f6fc8a3a84710bd016f5104baf89490cbc49c265a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5x5i4lfbepnlu2bcpixw7sfdvbdrbpibn5iqjoxyssimxre4ezna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/edfa8e2ca123daba68227a2f6fc8a3a84710bd016f5104baf89490cbc49c265a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

IcedID

html edfa8e2ca123daba68227a2f6fc8a3a84710bd016f5104baf89490cbc49c265a

(this sample)

fc8430951bc1451081327b8b91f82b1b65e2957cd02a16d7d21c307f08418d39

  
Link
https://tria.ge/221019-sekwpadcck/behavioral1
  
Dropping
SHA256 fc8430951bc1451081327b8b91f82b1b65e2957cd02a16d7d21c307f08418d39
  
Delivery method
Distributed via e-mail attachment

Comments