MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments 1

SHA256 hash:	05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295
SHA3-384 hash:	3b6e84975d9e89123e7df7b6f92cb44473f60570e2edcf95068528ecdce03832bc8bc9adf9cc8fa63635c04670d21b93
SHA1 hash:	57f0d9e823f14a7417d93fa7862d12b26370bc9f
MD5 hash:	5aa593ac49e932b86df93b7c03e9d914
humanhash:	monkey-oklahoma-hydrogen-spaghetti
File name:	КП-2024.pdf
Download:	download sample
File size:	1'364'380 bytes
First seen:	2025-05-16 07:20:47 UTC
Last seen:	2025-05-16 10:53:05 UTC
File type:	pdf
MIME type:	application/pdf
ssdeep	24576:I3tSKoiKkib69Ofs+0Po1Ump5jOy95LvBh83Th7u2zOvVNiqI35wYgMgSGh0ReGu:cEipOLCmpAyrz8Th7QvVNiLwY/gSGh0Q
TLSH	T14B5523F8B1A9944CF0C844047B372F8A9E9DB173A1CA1091752BC27B6648DB6F1762F7
Magika	pdf
Reporter	smica83
Tags:	APT28 pdf UKR

Intelligence

File Origin

# of uploads :

# of downloads :

570

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Other.Malware-gen.15139.12534.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6826e8a1e16384d6a704e748

Tags:

n/a

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295/results/dashboard

Document image

Image:

Download PNG

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6826e76ec609634bd7c53691/reports/9a9d156c-7db2-4b25-b066-1a8c9ec288a0/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295

Label:

Benign

Suspicious Score:

/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=05c3c887-cd45-4959-a5ba-7f8453681a52

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1691437

Behaviour

Behavior Graph:

n/a

Score:

Verdict:

Benign

File Type:

PDF

Link:

https://malprob.io/report/05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2024-01-22 15:42:58 UTC

File Type:

Document

Extracted files:

134

AV detection:

6 of 37 (16.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=axg2phhrc5m52b6e3xqusri6j3jkioyfm252kuaw5gqc3w36skkq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/05cda79cf11759dd07c4dde149451e4ed2a43b0566bba55016e9a02ddb7e9295

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Link

https://www.welivesecurity.com/en/eset-research/operation-roundpress/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

Szabolcs Schmidt commented on 2025-05-16 07:21:52 UTC

Attachment of c9bb17ae1dc2f92131473c8b61fe0a79