MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e
SHA3-384 hash:	e40f48fd12348dfc16560b3722e70c4ef7e6d65d5626de5188ff5f8a9d75e440a3aa8c1c8309f02d131d7fce423e4ab8
SHA1 hash:	5f5a5db59d98e5802178868de4373e1a4d13a10b
MD5 hash:	64fb7fcb5d4a2f0f062bca211d4479ab
humanhash:	india-harry-july-wolfram
File name:	Fattura_01153345.pdf
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	53'020 bytes
First seen:	2023-06-01 06:59:20 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:XkSBKvrX7yHCKBs7CofGkm5tMn/VEgp1uP5oOAzrfRoNea:0SBKvD7yiKBmCoOk8Mn/V1QbAzbRK
TLSH	T15F33B068E109A45FD047C6F1B72838920B5EF33375D56442347C4CCA7BD2E6DFA26A62
Reporter	JAMESWT_WT
Tags:	brt Gozi pdf Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

454

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/647841f4decac3b8d075a6a3/reports/f1a57f31-8d36-494f-98ba-7dc20f5332c8/overview

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

5.6/10

Score Malicious:

57%

Score Benign:

43%

Link:

https://www.malware.ai/gui/files/?id=c040c8c4-6bc6-42ce-9954-c4da66771237

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1246613

Signature

Antivirus detection for URL or domain

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Ursnif

Threat name:

Document-PDF.Trojan.Ursnif

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-05-31 13:52:06 UTC

File Type:

Document

Extracted files:

20

AV detection:

3 of 24 (12.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3lg3clnk6uyipt7wgdrrr6u5z7ud4xiahlckvmtwwclnds2uzexa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dacdb12daaf53087cff630e318fa9dcfe83e5d003ac4aab276b096d1cb54c92e