🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426
SHA3-384 hash: 0dd55c99740cdc16f2947c79059c1d9e151baf1c862869b7b89a21ad715fb07cf02dd7a86d18d409b69fbaaee9dd6bde
SHA1 hash: f1369377b3235e5604124ec2a1fff9456e9ac38e
MD5 hash: e659f40baddaefe5efab44b936419f15
humanhash: mississippi-bakerloo-cat-sodium
File name:1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426.pdf
Download: download sample
File size:148'911 bytes
First seen:2025-01-16 15:45:26 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 3072:tvnYdjHijSiD2mYSAwiLNJGCeVuqkiVwQCDqgq1TXwYhkHjnEa:tvYdjCjBcvGDhR1bwYKHwa
TLSH T1AEE3F023CD889CCCF1D7C3F6493A7D8E9C7DF31702C0AA9374B94A666D10A4E52219B9
Magika pdf
Reporter JAMESWT_WT
Tags:booking ItalianPasta pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
342
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=678929c34487910100dfa08c
Tags:
spawn sage remo
Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
macros
Link:
https://www.filescan.io/uploads/678929efbadbee3cec0afb83/reports/6e6b0671-a8b8-4cbc-9713-da2d08a1c91c/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426
Label:
Benign
Suspicious Score:
4/10
Score Malicious:
5%
Score Benign:
95%
Link:
https://www.malware.ai/gui/files/?id=0a4ca6b3-6a02-4136-add5-f66b66e2f2ba
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1592907
Signature
AI detected landing page (webpage, office document or email)
AI detected suspicious Javascript
Behaviour
Behavior Graph:
Download SVG
Score:
5%
Verdict:
Benign
File Type:
PDF
Link:
https://malprob.io/report/1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d75mwsfp426r7hlfkayzvqe7jx4usxns7xtscr6lp5ahtdc6wqta._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1ffacb48afe6bd1f9d6550319ac09f4df9495db2fde72147cb7f40798c5eb426

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments