MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750
SHA3-384 hash:	796e45c2adaff2864d04d37c70cb1c78910973d150df2d5ab5279818c750168eadcc35f63e394c2c122244d1ae2ea77d
SHA1 hash:	72205dfacbef24a74f9be749bfa79f98a1b4cbd7
MD5 hash:	ba049609fcc9b473cfb00a21fda46a3c
humanhash:	arizona-romeo-helium-spring
File name:	Voluptatem.pdf
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	91'831 bytes
First seen:	2023-04-06 10:39:40 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:oiGzD+kOIJZ1hlw1cfXppt/Et51miA3TUJuERGXJC/kIz6gB+2lx0iIY+sBqocry:jGWkTJ7KqOtT4EMIzTpHmcj0KEA
TLSH	T16C93F151A068A46DE806B77AD045FF65072F740310C6FB3F61912CCDE08DAA0E666BFE
Reporter	proxylife
Tags:	1680772777 BB22 pdf Qakbot qbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

497

Origin country :

RU

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Pdf.Downloader.Qakbot-9989703-0

Alert

Create hunting rule

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

phishing remote

Link:

https://www.filescan.io/uploads/642ea182da5bf6666c9cdd5c/reports/7bcf144e-dce8-4434-a2fb-8e443dc91cb6/overview

Hybrid Analysis Pdf/malicious_confidence_60%

Verdict:

Malicious

Labled as:

Pdf/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

1.6/10

Score Malicious:

17%

Score Benign:

83%

Link:

https://www.malware.ai/gui/files/?id=38605ea4-f3c1-4ddb-a524-fcca9815c682

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

phis

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/1209585

Signature

Antivirus detection for URL or domain

Downloads suspicious files via Chrome

Multi AV Scanner detection for submitted file

PDF lure found (based on various OCR indicators)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750/

ReversingLabs TitaniumCloud Document-PDF.Dropper.Heuristic

Threat name:

Document-PDF.Dropper.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-06 10:40:08 UTC

File Type:

Document

Extracted files:

3

AV detection:

5 of 37 (13.51%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x27q3p6eofyx6j77bihmxvmr57ony3wyj2jdqdxzqkchqxaok5ia._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bebf0dbfc471717f27ff0a0ecbd591efdcdc6ed84e92380ef98284785c0e5750