MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0fbe0024554ee9aee8d6c5814bf16e33d9a90425ea7230ac72ae7f4e2df73938. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0fbe0024554ee9aee8d6c5814bf16e33d9a90425ea7230ac72ae7f4e2df73938
SHA3-384 hash:	db66cec0eea77a9313fe1834be65592f3f2c64f33dc2c69ff4f44cd30c863650eb7a8c53237bb91bca5dceb0a8c2d299
SHA1 hash:	9c941e42f6065962ce6d0035d2cf8d3d9aeb44d3
MD5 hash:	95ac7f1da2334fa9d695664c5b8be3f2
humanhash:	sixteen-nitrogen-golf-early
File name:	Paid_Offer_268_Jan-19.pdf
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	139'496 bytes
First seen:	2023-01-20 00:32:15 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	3072:k59bPadhK2by1Qt0buXiOiJxqeynSFyYVjTNPe2Nk6FL0E+FuA9Y8mmS3G:JG40buSOibqeUAyoTRe81LfamG
TLSH	T161D31207E21BA960DF2E40BA5704105FFEF7B44605EDA5B1A3EB0496877E4BBCD14B88
Reporter	proxylife
Tags:	3108046779 IcedID pdf ragpewleaK

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

437

Origin country :

IE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.PDF.GoogleStorage-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/0fbe0024554ee9aee8d6c5814bf16e33d9a90425ea7230ac72ae7f4e2df73938/results/dashboard

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63c9e13f1c9cbf7d62507a75/reports/6fd491b7-6f6c-4dcf-8f04-d11e74154c45/overview

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

2/10

Score Malicious:

3%

Score Benign:

97%

Link:

https://www.malware.ai/gui/files/?id=b35c6b52-da40-43e9-b82b-59d08c813b72

Joe Sandbox Qbot Downloader

Result

Threat name:

Qbot Downloader

Alert

Create hunting rule

Detection:

malicious

Classification:

spre.troj

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1155194

Signature

C2 URLs / IPs found in malware configuration

Yara detected Qbot Downloader

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0fbe0024554ee9aee8d6c5814bf16e33d9a90425ea7230ac72ae7f4e2df73938/

ReversingLabs TitaniumCloud Document-PDF.Trojan.IcedID

Threat name:

Document-PDF.Trojan.IcedID

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-01-20 00:33:07 UTC

File Type:

Document

Extracted files:

2

AV detection:

9 of 26 (34.62%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b67aajcvj3u252gwywaux4logpm2sbbf5jzdbldsvz7u4lpxhe4a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0fbe0024554ee9aee8d6c5814bf16e33d9a90425ea7230ac72ae7f4e2df73938