MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd
SHA3-384 hash:	b2ae0bd30e0699a61b385d964f5e5e10009f249418ee3340aa15f80f8ec39b5ecd815b2a6b919a30715f90be63499506
SHA1 hash:	48ecf125c6d996599a8adf2c826a083e212e0e77
MD5 hash:	bc3e83a047ffa7c905f38c146542f2f9
humanhash:	december-burger-summer-chicken
File name:	RIMESSA_CASSEGNI16032023-2900.pdf
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	25'032 bytes
First seen:	2023-03-16 09:14:32 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	768:hgMRyuzcyTgJb+5B2VVmaHsviiv9VXquAN07wFFg:mMRNzG+5sUaHsviS3aaWq
TLSH	T158B2CF6C5978D84DC44547341A2F371EABC8F56142E56CDE04B8E2A0B04BDBB7949A3F
Reporter	JAMESWT_WT
Tags:	GLS Gozi ITA Loader pdf Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

345

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6412de1727c971bfffb891f7/reports/09188b0c-11b4-4f40-8932-dd73df5fe5cb/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

1.6/10

Score Malicious:

16%

Score Benign:

84%

Link:

https://www.malware.ai/gui/files/?id=257cef9b-9948-4648-bce7-c23a7d3fcc6c

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Document With Few Pages

Document contains between one and three pages of content. Most malicious documents are sparse in page count.

Joe Sandbox clean

Result

Threat name:

Unknown

Detection:

clean

Classification:

n/a

Score:

0 / 100

Link:

https://www.joesandbox.com/analysis/1194805

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dfeoxwlvofjakii6bzqvedbxeuegr6gp6slxxglymsggl3tustoq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1948ebd975715205211e0e61520c37250868f8cff4977b9978648c65ee7494dd