MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe48d46623a9acfb1bcc9828ceafbf463624a3acc2140f8015169e48f5749f50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe48d46623a9acfb1bcc9828ceafbf463624a3acc2140f8015169e48f5749f50
SHA3-384 hash: e56ee0a189dffc4691ad62d2a2ccd592ca5dd95bbf3077e68c08afaa6053314ec5de71cd00a2cf0c82a3a3484c8cca87
SHA1 hash: e8b820966cb62d971cf03f647d138492a7048b7a
MD5 hash: 64b0ed131d43f14cee1c08cf8bb39ac8
humanhash: tango-zulu-fillet-nine
File name:Scan003883 pdf.rar
Download: download sample
File size:36'782 bytes
First seen:2020-10-19 07:22:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 768:OzSWcaOon1ljIUfSH2RXMnrUiYbC1Xn5Gjx+27gWBFHJAkicv:QSWJOWljI/GXiYmhqx+yFpnv
TLSH EDF2F1D1B133F3FB998B4EEC519CC467C9FA24008EE9400CC7B66C17E0A5DA3B69509A
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: zimbra58.go4hosting.in
Sending IP: 111.118.184.59
From: stephen@wescomail.us
Subject: New Enquiry - Wescomail Inc USA
Attachment: Scan003883 pdf.rar (contains "Scan003883 pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fe48d46623a9acfb1bcc9828ceafbf463624a3acc2140f8015169e48f5749f50/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 04:25:33 UTC
AV detection:
3 of 48 (6.25%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7zenizrdvgwpwg6mtaum5l57iy3cji5myika7aavc2per5lut5ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fe48d46623a9acfb1bcc9828ceafbf463624a3acc2140f8015169e48f5749f50

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar fe48d46623a9acfb1bcc9828ceafbf463624a3acc2140f8015169e48f5749f50

(this sample)

Executable exe cfd84da3b4eb2d8a6de6e0093a1d7399b92493d1b4499afa4c0e9572029ac1e8

  
Dropping
MD5 b02ed26d410c2e1ea7f147a7fd59c6aa
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cfd84da3b4eb2d8a6de6e0093a1d7399b92493d1b4499afa4c0e9572029ac1e8

Comments