MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd5df28ed212183d98dac2e785e7cb9703769871585b6702b0a975b0c307b874. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bd5df28ed212183d98dac2e785e7cb9703769871585b6702b0a975b0c307b874
SHA3-384 hash:	d57b0f1d438cdb68e6a3ed359d494e90fa702c6547749bf688d74787d9d779ad877de19bc785fccfc763513c894a4e04
SHA1 hash:	924ad5b20dcdeef52c47e497e42726b2d4019244
MD5 hash:	e17daca1c951e357d383fa9062cddcb6
humanhash:	lima-happy-wyoming-steak
File name:	8_IT05953829442_90_26042023_029000.pdf
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	179'726 bytes
First seen:	2023-04-28 06:30:52 UTC
Last seen:	2023-04-28 06:34:52 UTC
File type:	pdf
MIME type:	application/pdf
ssdeep	3072:Olv1U1qS1maNhyWyLrbYfEZwcYqJmaA4jfntQ1aIC7GzS4e+q5EOcmmMsb8D+1VT:OZ1uQaDlyLr2AX7A4jtt7aW4CpkADQ
TLSH	T1A004CE471A58E395C01C09E4AC471EE82E0B2719E9852EFB741E4F9F3F41A736CDA46E
Reporter	JAMESWT_WT
Tags:	DhlCredit Gozi pdf Ursnif

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

412

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/bd5df28ed212183d98dac2e785e7cb9703769871585b6702b0a975b0c307b874/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  2/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/644b682a961a21dc785bc1ca/reports/b2bee7b5-62fb-4655-a166-03aec9e5c3eb/overview

Hybrid Analysis Pdf/malicious_confidence_60%

Verdict:

Malicious

Labled as:

Pdf/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/bd5df28ed212183d98dac2e785e7cb9703769871585b6702b0a975b0c307b874

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

7/10

Score Malicious:

8%

Score Benign:

92%

Link:

https://www.malware.ai/gui/files/?id=b5951b3e-297c-4c2f-becc-cb089ac6fbb6

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

1 / 100

Link:

https://www.joesandbox.com/analysis/1222084

Behaviour

Behavior Graph:

n/a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bd5df28ed212183d98dac2e785e7cb9703769871585b6702b0a975b0c307b874/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Ursinf

Threat name:

Document-PDF.Trojan.Ursinf

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-27 10:32:49 UTC

File Type:

Document

Extracted files:

8

AV detection:

4 of 37 (10.81%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xvo7fdwscimd3gg2yltylz6ls4bxngdrlbnwoavqvf23bqyhxb2a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.