🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8
SHA3-384 hash: dd0a36930dde9c09a61f6d3bb8c8e651cccf5412b2920bb9fecfb628f4e0a11dada9309fac3255804a352cd9ab66f556
SHA1 hash: 4f0ed6789bd62fdcc64c491a7c8a5164c4b67c2b
MD5 hash: 99bc869b52239183fda67c83d311f4f8
humanhash: autumn-gee-autumn-queen
File name:20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8
Download: download sample
File size:74'612 bytes
First seen:2025-09-19 08:22:08 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 1536:0lGjwP6rFvh7IQaYHVstgqGtLjPNqaewnZaGnXvxhdB:0lGjwP6rF9aYHVsextLx5eonXJJ
TLSH T1DB735B5FB908458DE4A8CAD0FA233CDD5B1F332989C830D6793C1E57BB24565AE8924F
Magika pdf
Reporter JAMESWT_WT
Tags:myftpupload-com pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
438
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68cd12d76b621794b130dbcb
Tags:
vmdetect phishing
Result
Verdict:
Suspicious
File Type:
PDF File
Link:
https://app.docguard.net/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
action anti-vm phishing
Link:
https://www.filescan.io/uploads/68cd12e9254431b688d4c363/reports/a4c06aac-7d8d-4971-85a7-685cc5fc3239/overview
Verdict:
Malicious
Labled as:
Pdf/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8
Label:
Benign
Suspicious Score:
2.3/10
Score Malicious:
24%
Score Benign:
76%
Link:
https://www.malware.ai/gui/files/?id=97fcdb1a-b1d7-40a3-a640-a593f5c5d51b
Verdict:
Malicious
File Type:
pdf
First seen:
2018-07-09T07:28:00Z UTC
Last seen:
2018-07-09T07:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
PDF
Link:
https://malprob.io/report/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8
Verdict:
inconclusive
YARA:
3 match(es)
Link:
https://app.malva.re/file/99bc869b52239183fda67c83d311f4f8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8/
Threat name:
Document-PDF.Phishing.Generic
Create hunting rule
Status:
Malicious
First seen:
2018-07-14 03:47:00 UTC
File Type:
Document
Extracted files:
5
AV detection:
13 of 38 (34.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edetrnggsdi6yra2p32wnbv33srojygxu3dpb37sfziw2ziqto4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.40
Link:
https://yomi.yoroi.company/submissions/20c938b4c690d1ec441a7ef56686bbdca2e4e0d7a6c6f0eff22e516d65109bb8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments