MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d
SHA3-384 hash:	43f005c2bd069c35adc59edb41206f4a7c87efe4345ee0f7f96f5bba627e856669f630188e8219759965bb030f3f1a0e
SHA1 hash:	7b621dcaabd1f833f8381bbe9cc8898dd09c95b2
MD5 hash:	f42544fe0db583e4b836e4b8cfc52802
humanhash:	arizona-indigo-eight-six
File name:	NDA-1337-May10.pdf
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	62'173 bytes
First seen:	2023-05-10 16:58:14 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	768:K0jVjgocGH4FBncGH4FBQNsgecGH4FBscGH4FBIacGH4FBPYLnnndTVrXmm1wDsv:pXcs8csxecstcstacsaMnnn76gmAV
TLSH	T19B53F89CA48CD598C9B9EBF3E752F0CAE24D737B4A8A44B271AF5FD20243D15E943841
Reporter	proxylife
Tags:	obama262 pdf Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

508

Origin country :

DE

Vendor Threat Intelligence

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/645bcd56ca21d4c52e1bb09c/reports/1651f9db-0bbc-4334-8f5d-f19571676cd4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

/10

Score Malicious:

%

Score Benign:

1%

Link:

https://www.malware.ai/gui/files/?id=74c5766c-a56d-4073-a953-3d5eb04f1e25

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1230263

Signature

Clickable URLs found in PDF pointing to potentially malicious files

Found potential malicious PDF (bad image similarity)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Heuristic

Threat name:

Document-PDF.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-10 16:59:05 UTC

File Type:

Document

Extracted files:

26

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gqldflbakqg435g5nt3govid43nt4l2rhy43whez2rqd4bwmrsoq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Qakbot

Threat name:

Qakbot

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/341632ac20540dcdf4dd6cf6675503e6db3e2f513e39bb1c99d4603e06cc8c9d