🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41
SHA3-384 hash: 80db1499e4bf45c29a816a3ce989408be845cb8b8543dc637a3caaa30a9feff8155afd130ca94216c172d308cf314f50
SHA1 hash: 0cd3ca22f1a0cc47e852d241752fcd679794c539
MD5 hash: 13755b19d7047c590b580669fe706216
humanhash: august-robert-carolina-florida
File name:REQUESTFORQUOTATION.pdf
Download: download sample
File size:265'657 bytes
First seen:2026-11-09 07:44:06 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 6144:ZTMBS0FJ78nLo4qDMoqSijrKQtJAP/Z36uiVPcA:ZQI0/YnLo4qFCAnkDxJ
TLSH T1E844F106880CEACED28203D47F173D6D7A5E7365B9C415A1366ECACB4B80FB9D85B44E
Magika pdf
Reporter ni_fi_701
Tags:pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1c2551492c978625a6691
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Result
Verdict:
Malicious
File Type:
PDF File
Link:
https://app.docguard.net/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41/results/dashboard
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41
Gathering data
Verdict:
Unknown
File Type:
pdf
Link:
https://opentip.kaspersky.com/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
phis
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/2001324
Signature
AI detected malicious page (phishing or scam)
AI detected malicious PDF file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2001324 Sample: REQUESTFORQUOTATION.pdf Startdate: 09/11/2026 Architecture: WINDOWS Score: 52 39 AI detected malicious page (phishing or scam) 2->39 41 AI detected malicious PDF file 2->41 7 chrome.exe 6 2->7         started        10 Acrobat.exe 20 58 2->10         started        12 chrome.exe 2->12         started        process3 dnsIp4 29 192.168.2.7, 138, 443, 49193 unknown unknown 7->29 14 chrome.exe 7->14         started        18 chrome.exe 7->18         started        20 chrome.exe 7->20         started        22 AcroCEF.exe 107 10->22         started        process5 dnsIp6 33 team.design 151.101.194.159, 443, 49752, 49753 FASTLY-FastlyIncUS Canada 14->33 35 mobile-gtalk.l.google.com 142.250.141.188, 49748, 5228 GOOGLE-GoogleLLCUS United States 14->35 37 11 other IPs or domains 14->37 27 Chrome Cache Entry: 424, PDP-11 14->27 dropped 24 AcroCEF.exe 6 22->24         started        file7 process8 dnsIp9 31 18.211.136.6, 443, 49724 AMAZON-AES-AmazoncomIncUS United States 24->31
Verdict:
inconclusive
YARA:
3 match(es)
Link:
https://app.malva.re/file/13755b19d7047c590b580669fe706216
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41/
Threat name:
Document-PDF.Trojan.Tnega
Create hunting rule
Status:
Suspicious
First seen:
2026-11-09 07:45:11 UTC
File Type:
Document
Extracted files:
20
AV detection:
4 of 22 (18.18%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nilrkpkuclmmmqa2v6q7fuuwlapps2zx5d5bjhdjaryoi2zuvvaq._file
Malware Family:
outbreak
Create hunting rule
Malicious:
True
Tags:
pdf
Link:
https://intel.virussign.com/intelligence/file/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/6a17153d5412d8c6401aafa1f2d296581ef96b37e8fa149c690470e46b34ad41

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments