MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb
SHA3-384 hash:	a9e222a281e449a800d70e52dffef95cb61a4ff1526ebe7220304389efc59c892bb04a4d1941abc5e96569b26e2a3d3b
SHA1 hash:	5872dfc3059d5bd18226819d8a11097097e0bfe2
MD5 hash:	0c048ed07c5754f4efa55e2f42a9e9cc
humanhash:	juliet-oranges-coffee-snake
File name:	comunicazione(1).pdf
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	60'187 bytes
First seen:	2023-06-21 10:57:19 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:mY/fBo1tl5HIPgQbymbPZL12nuyyctlSz3kD:mY/Zo1v5ogQby8Z5P8iq
TLSH	T18443E1BAE2B9946CD5C71C21DE2B35C1DFCCF2A28AC571C614BB5DBA4418C6CDE801DA
Reporter	JAMESWT_WT
Tags:	agenziaentrate balkun-com civis Gozi ITA pdf Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

484

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6492d7ba99f0c0cb093333be/reports/7248fc59-3973-4e9a-9bec-bad69cb073d4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

1.8/10

Score Malicious:

18%

Score Benign:

82%

Link:

https://www.malware.ai/gui/files/?id=a239167f-0bc6-488a-b5bf-6293d44cd921

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1258950

Signature

Multi AV Scanner detection for domain / URL

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Ursnif

Threat name:

Document-PDF.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-06-21 10:11:03 UTC

File Type:

Document

Extracted files:

8

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wo5h6cpfktlxluapuuvu4hvscwp43b3iftd3ztkkcftcbnpvlxfq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/b3ba7f09e554d775d00fa52b4e1eb2159fcd87682cc7bccd4a116620b5f55dcb