MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf
SHA3-384 hash:	9e6f9757b41a950753d9f7807ed3207f5f2557e927b23bb831875a11a2af3571ea3344acb587ba369e2864591d6a0684
SHA1 hash:	943fc4384276129f62430d0aba49cd7d51810d2a
MD5 hash:	4c85f58df1e88d2c44058feb8c7ca35b
humanhash:	september-florida-happy-blue
File name:	Z Rosja jeszcze sie nie zintegrujemy.pdf
Download:	download sample
File size:	226'009 bytes
First seen:	2023-01-26 17:01:43 UTC
Last seen:	2023-02-01 23:17:15 UTC
File type:	pdf
MIME type:	application/pdf
ssdeep	6144:Imx23oabOFmc/uqV8PWCc8pVm/ztavMdJs:Id39kmc/uqax/m/zgvAs
TLSH	T1E0242336554B9EBFE35A8E0F348CE607F442334795CD9EC43B56C2DA198E914730A8EA
Reporter	atomiczsec
Tags:	pdf

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

373

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Swf.Exploit.Kit-513

Alert

Create hunting rule

SecuriteInfo.com.Exploit.JS.Pdfka.env.26713.7724.UNOFFICIAL

Alert

Create hunting rule

PUA.Win.Trojan.EmbeddedPDF-2

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

PDF File

Link:

https://app.docguard.net/b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

CVE-2010-3654 exploit virus

Link:

https://www.filescan.io/uploads/63d2b20b905a5ac3b908df4a/reports/b30f66f5-4ac7-48ba-a961-1abc6d81274f/overview

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.3/10

Score Malicious:

93%

Score Benign:

7%

Link:

https://www.malware.ai/gui/files/?id=d90cc4e4-7d7e-4f5f-8b6f-8a34f18b95c9

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/1159717

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf/

ReversingLabs TitaniumCloud ByteCode-SWF.Exploit.CVE-2010-3654

Threat name:

ByteCode-SWF.Exploit.CVE-2010-3654

Alert

Create hunting rule

Status:

Malicious

First seen:

2011-05-24 16:09:00 UTC

File Type:

Document

Extracted files:

3

AV detection:

26 of 39 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wi2ntzhjdxxgbd3pdufg5iskhpflmi6jhvpazibhf7l2bd6y57pq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf