🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed
SHA3-384 hash: 0d46e4eef893e5a0c5178800dd84b2e0073021da7cac5fdfba570f6bfd2452045caf3af986337abc38859607469c143b
SHA1 hash: 74088b22382127f88abc230ce9a5e5d0c37a93da
MD5 hash: eb5d23a6a200016ba9b2d0085e58b586
humanhash: nevada-cold-lion-sink
File name:54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed.pdf
Download: download sample
File size:39'157 bytes
First seen:2025-04-12 12:46:27 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 768:MLIIcXe6KUvHweV4wdbwvnVja+JiG6b6CwS1bw5BCahMNKPckBWWm4Kts:gEj4wdbw/VZiGRCwSe5B20EU
TLSH T179031A038C184B97E52583F8BE072D6D6A0A7A5DF4C232FD01374ECB2E21A755C5E56E
Magika pdf
Reporter JAMESWT_WT
Tags:diffgrinder-info pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
460
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67fa69d61dba888a93d1a01a
Tags:
ransomware extens sage
Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
action phishing
Link:
https://www.filescan.io/uploads/67fa60cf2d430c849e158d0f/reports/1fb018d8-728a-4a82-9966-8c5a671248f4/overview
Verdict:
Suspicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed
Label:
Benign
Suspicious Score:
3.0/10
Score Malicious:
3%
Score Benign:
7%
Link:
https://www.malware.ai/gui/files/?id=925cd9a9-0e14-45d3-8ea6-124876a9cc4f
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
21 / 100
Link:
https://www.joesandbox.com/analysis/1663787
Signature
AI detected landing page (webpage, office document or email)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1663787 Sample: 6l5CmDFjj5.pdf Startdate: 12/04/2025 Architecture: WINDOWS Score: 21 22 x1.i.lencr.org 2->22 24 sharetobijoy.buzz 2->24 26 2 other IPs or domains 2->26 38 AI detected landing page (webpage, office document or email) 2->38 8 chrome.exe 2 2->8         started        11 Acrobat.exe 20 72 2->11         started        13 chrome.exe 2->13         started        signatures3 process4 dnsIp5 28 192.168.2.4, 138, 443, 49180 unknown unknown 8->28 15 chrome.exe 8->15         started        18 AcroCEF.exe 107 11->18         started        process6 dnsIp7 30 www.google.com 108.177.122.105, 443, 49740, 49749 GOOGLEUS United States 15->30 32 sharetobijoy.buzz 15->32 34 google.com 15->34 36 e8652.dscx.akamaiedge.net 23.55.253.31, 49726, 80 AKAMAI-ASN1EU United States 18->36 20 AcroCEF.exe 2 18->20         started        process8
Score:
100%
Verdict:
Malware
File Type:
PDF
Link:
https://malprob.io/report/54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-03-03 21:31:03 UTC
File Type:
Document
Extracted files:
5
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ktakj364k3yt566umzyca5klb2dzq3qozkhkr2joytfjcx6kb3wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/54c0a4efdc56f13efbd4667020754b0e87986e0eca8ea8e92ec4ca915fca0eed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments