MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f
SHA3-384 hash:	654b55ea09980f21c4953225ba086e095a9896845ee4da2b4d9dfc3b1d3b2c5accdc13e45f9c5c9357a53a98b9aa8043
SHA1 hash:	d04b18ce9809a3bf61920c2cd44b5e4720d9d617
MD5 hash:	0ff9527dfb3bb2323608fc010f6da2e4
humanhash:	winter-river-crazy-colorado
File name:	claim-11-2-882IEO776-23.pdf
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	212'459 bytes
First seen:	2023-11-07 04:41:03 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	6144:iai3/or3B8vmAii7rmHww2ArEJmR7uPdRSAJF/f0:iai3Ar3KnrmQw2A4OAdRPF/M
TLSH	T1BF2401A83435C450DD9BA5B11B5C3FC3A5CBC1F218D62023D072AA9F367EC23B4A15EA
Reporter	V3n0mStrike
Tags:	DarkGate pdf

V3n0mStrike

#darkgate campaign .cab file download from https://adclick.g.doubleclick.net/pcs/click?fj2-NOVEMBER-23-RefHHB119kd&&adurl=//marmorariaxangrila.com.br/

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

753

Origin country :

CL

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PUA.PDF-URI-Obfus-1.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6549c01a946b6ab22459cf03/reports/ed2ab2b6-362b-4892-abc2-9c40c5acf205/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

4.0/10

Score Malicious:

41%

Score Benign:

59%

Link:

https://www.malware.ai/gui/files/?id=0b99ae5e-1087-459e-9633-4425e70ad101

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

phis

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1338049

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suspicious PDF detected (based on various text indicators)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Heuristic

Threat name:

Document-PDF.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-11-03 16:57:55 UTC

File Type:

Document

Extracted files:

58

AV detection:

11 of 38 (28.95%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qtwnmwjipzorxmupst4ihht3rz2k74dmkkhpartvar6na3t3pwpq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DarkGate

pdf 84ecd659287e5d1bb28f94f8839e7b8e74aff06c528ef04675047cd06e7b7d9f

(this sample)

any.run

https://app.any.run/tasks/00c0d753-a669-4573-a097-094f6fe0f2d4/#

  

Delivery method

Distributed via e-mail attachment