MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f65ea73ea5a0adb0b34714d37cfb1e78a8bc84d15dc64f6348915fa14ed98a5e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 7
| SHA256 hash: | f65ea73ea5a0adb0b34714d37cfb1e78a8bc84d15dc64f6348915fa14ed98a5e |
|---|---|
| SHA3-384 hash: | 09b2022bba64bf74c9c2d509ab368e362a3cfe7bc1106b9e3d73cd12f3a86ce42541798db447347828508cbfbb83a9f6 |
| SHA1 hash: | f28f0e4f85bbbeb0164afd99012b4aac9ae59304 |
| MD5 hash: | 704e7304a4b48bb62b5756d2a9497eb8 |
| humanhash: | cold-spring-winner-indigo |
| File name: | SWIFT COPY.jpg.exe |
| Download: | download sample |
| File size: | 959'488 bytes |
| First seen: | 2021-03-24 19:19:07 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| ssdeep | 6144:xsv+fVFR3q2XGH9oQAXK2yDwIvP7Zl8cp77BLPyHRl:xsWfVFjfQAa2yDwIvFl8cFhyHH |
| Threatray | 43 similar samples on MalwareBazaar |
| TLSH | D315B98C5D9AC2C6C6754BB882CA84E946D95FF34F22F8BAB9C847CBC130745F506D26 |
| Reporter |  abuse_ch |
| Tags: | exe |
abuse_ch
Malspam distributing unidentified malware:HELO: vps102166.ovh.net
Sending IP: 92.222.178.132
From: paco@gpbati.be
Subject: SWIFT Transfer (103) IR07802011023430
Attachment: SWIFT COPY.jpg.ace (contains "SWIFT COPY.jpg.exe")
Intelligence
File Origin
# of uploads :
1
# of downloads :
130
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SWIFT COPY.jpg.exe
Verdict:
No threats detected
Analysis date:
2021-03-24 19:50:09 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Signature
.NET source code contains potential unpacker
Machine Learning detection for sample
Uses an obfuscated file name to hide its real file extension (double extension)
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Wacatac
Status:
Malicious
First seen:
2021-03-24 19:20:09 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 33 additional samples on MalwareBazaar
Unpacked files
SH256 hash:
f65ea73ea5a0adb0b34714d37cfb1e78a8bc84d15dc64f6348915fa14ed98a5e
MD5 hash:
704e7304a4b48bb62b5756d2a9497eb8
SHA1 hash:
f28f0e4f85bbbeb0164afd99012b4aac9ae59304
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
1d3b03f498f96b893876f1e20f3dfd20
exe f65ea73ea5a0adb0b34714d37cfb1e78a8bc84d15dc64f6348915fa14ed98a5e
(this sample)
Dropped by
MD5 1d3b03f498f96b893876f1e20f3dfd20
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.