MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9
SHA3-384 hash:	dd435671b7c2592a9471cf03d45f9ae79b61dba2663892f705fd8743470c390cf8fcc23bcd52ba228932422f4b168df2
SHA1 hash:	356ba1d838e6788c9f9fea4efa47b1678b32524e
MD5 hash:	9a211d74457aa871e953b1f3e9747488
humanhash:	yellow-jersey-dakota-idaho
File name:	DSV-Invoice-S6452360-signed.pdf.pdf
Download:	download sample
Signature	WikiLoader Alert Create hunting rule
File size:	52'376 bytes
First seen:	2024-01-16 17:38:14 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	768:hZvodo4GmenU7z+xyysAmTv8PClyEuFLVDD/n3SK9LnYpip3zg+6T+sMNtsv2tyu:vvom4neny8kv8PCkVRvr9X056sMN+q6y
TLSH	T1A533D031F286DA48EF13C16D413E3E3F4FECB6DA15C5248B24390954E356F69A88396E
Reporter	proxylife
Tags:	pdf WikiLoader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

575

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Rogue.0hr.20240117-0332.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2.5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/65a6bf3c784d3498d7406a00/reports/5ce9b158-0163-4431-ae8d-8403901873b2/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

1.4/10

Score Malicious:

15%

Score Benign:

85%

Link:

https://www.malware.ai/gui/files/?id=ff5b701c-4be2-4c6b-b86e-662d4184a3da

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1375588

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Wikiloader

Threat name:

Document-PDF.Trojan.Wikiloader

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-01-16 17:02:35 UTC

File Type:

Document

Extracted files:

12

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bp5u55e6qbb6u5lvvjnjn25eicv25yrrnnysbq2a75zdm5s7jl4q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/0bfb4ef49e8043ea7575aa5a96eba440abaee2316b7120c340ff7236765f4af9