MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f
SHA3-384 hash:	dd41f24a29988fa8e372d51f31b9b444b97b1bbf0957114aaf14efa9dd7d00c52372d0d44d0018a2ef4fa30e1f495581
SHA1 hash:	151349e17b1ee1a81acebc75a12517bf5b2f2acd
MD5 hash:	856d4b63bfbfb3b17930a96350bfefef
humanhash:	robert-three-snake-carbon
File name:	ds.pdf
Download:	download sample
Signature	IcedID Alert Create hunting rule
File size:	443'867 bytes
First seen:	2023-10-16 16:19:18 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	12288:7gIDh7qioGYHiT1LNOJtUuiA5La4mmadcynCP:7Lh7qFZHiT1hui592
TLSH	T1E694233497678FFF00BC19EA3E51B1CDB85940875B768A0AC2B3B6FB5AB5D52E031052
Reporter	0x_malw_research
Tags:	geo IcedID pdf

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

620

Origin country :

GB

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PDF.Phish-5.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

phishing polyglot

Link:

https://www.filescan.io/uploads/652d62b4f776149b0b31f54f/reports/21cf35d7-9f42-4d32-b8fd-55fa605c6e4d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

2.9/10

Score Malicious:

29%

Score Benign:

71%

Link:

https://www.malware.ai/gui/files/?id=7dd440c7-73d3-4ef5-99c5-dbc34991128e

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1326709

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Heuristic

Threat name:

Document-PDF.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-16 16:20:07 UTC

File Type:

Document

Extracted files:

1

AV detection:

15 of 37 (40.54%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pgzv7bonac3ndh5euhmlzfso7hjqkpjfbnyodhz65kdshm64r6hq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/79b35f85cd00b6d19fa4a1d8bc964ef9d3053d250b70e19f3eea8723b3dc8f8f