MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0
SHA3-384 hash:	ee518a625e47426aea6d43d219f34f95730097fb99e572d556d4634ebc3c340a5a0fbdc383e491164f3d3641bd765240
SHA1 hash:	f7cc766d69dd91f064b6ad3cb3b6d9d97d2724a4
MD5 hash:	277a3e91da0bae5c70f1b4b5d7278eab
humanhash:	bakerloo-floor-aspen-apart
File name:	Doc_Scan_09-12_54.pdf
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	32'780 bytes
First seen:	2023-09-13 10:02:43 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	768:fA2VYWU1jzJQvOemHalzgfLcBZzYnZVmeI4QVhHni4pr8brePwtWA5ZSoy:o2GWWsmy+RupVVV9rVY1/y
TLSH	T195E2E198C1E69583CE231537C4FD9C9464EA3A64CBD9F2731E60899D21F25B6DF13290
Reporter	Mangusta
Tags:	909843654 IcedID pdf pw-975 vocesdelatinoamerica-com

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

517

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

phishing

Link:

https://www.filescan.io/uploads/650188d89bae8a37855514f0/reports/ad79d5db-d801-4f3e-b3e4-bc3b844d89f1/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

2/10

Score Malicious:

2%

Score Benign:

98%

Link:

https://www.malware.ai/gui/files/?id=dcd62c21-8d81-4caa-a731-d77b841e9749

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1308261

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0/

ReversingLabs TitaniumCloud Document-PDF.Trojan.IcedID

Threat name:

Document-PDF.Trojan.IcedID

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-13 10:03:05 UTC

File Type:

Document

Extracted files:

1

AV detection:

11 of 23 (47.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ishapufrp4773mxxjqvfb374fglzw6unlr6uth6reb54qr2h4sqa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI IcedID

Threat name:

IcedID

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/448e07d0b17f3ffdb2f74c2a50effc29979b7a8d5c7d499fd1207bc84747e4a0