MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Stealc

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c
SHA3-384 hash:	d2349b8be97fbb7c2c8f26f68e0df40a8291616ab475fa40713efa18ca02d7ad4d00cf709ca6113f1102711a45f371e1
SHA1 hash:	18e9e6d893bab03d9b1a47951c9d408a31c59ba4
MD5 hash:	cfab7a2f5302b8fcdd98159c3c892404
humanhash:	glucose-thirteen-winner-ohio
File name:	Agreement_eSign.pdf
Download:	download sample
Signature	Stealc Create hunting rule
File size:	86'773 bytes
First seen:	2024-02-04 06:43:22 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:hqICCqKqIXY1RYZpfg99xyUb1V7fbxp7kWJx362lKXH7WPsi4Dym15gF:hqLdIGYZiZbz7FpJJxUCPsiSn1GF
TLSH	T1DE83026E8D270483E8DB1EBA744C69B34A6B12DB23112EE53524DB730844BDB7E50BF5
Reporter	iamdeadlyz
Tags:	194-120-116-120 CVE-2023-27363 pdf Stealc

Iamdeadlyz

Outfoxing a Malicious PDF: An attacker's attempt to deliver a Stealc infostealer. Exploiting CVE-2023-27363.

Drops officeupdate.hta [persisting via startup folder]
Retrieves: hxxps://brazilanimalshelp[.]com/updating/stale.exe
StealC C&C: hxxp://194.120.116[.]120/7a957ef6cc168ff6.php

Intelligence

File Origin

# of uploads :

# of downloads :

526

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Script.SNH-gen.31932.19867.UNOFFICIAL

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/65bf3233b012cce0edbb85a7/reports/7411662d-db4a-4f09-9070-37cd2f872542/overview

Verdict:

Suspicious

Labled as:

Trojan.Script.Heuristic

Link:

https://www.hybrid-analysis.com/sample/3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c

Label:

Benign

Suspicious Score:

4.6/10

Score Malicious:

47%

Score Benign:

53%

Link:

https://www.malware.ai/gui/files/?id=1324c46b-b30d-4265-a801-98cd6e5f1d06

Result

Verdict:

MALICIOUS

Details

Malicious Scriptlet 7 of 7

Detected a malicious pivot typically seen during the 'file-less' pivot commonly seen in malware carriers.

Document With Minimal Content

Document contains less than 1 kilobyte of semantic information.

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1386274

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c/

Threat name:

Document-PDF.Trojan.Stealc

Status:

Suspicious

First seen:

2024-01-31 22:01:45 UTC

File Type:

Document

Extracted files:

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g547doie5zgpih2kezsqksigqjkz2cjtpxvtbiwmbb4tyltjhboa._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Stealc

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3779f1b904ee4cf41f4a266505490682559d09337deb30a2cc08793c2e69385c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.