🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956
SHA3-384 hash: 9941d9565bff9b032529128e922feded32735cfc0568457415530f3b87363c9c842d26ffa39ab342167dbe7cdb024f93
SHA1 hash: 6ee4537f579288e82bacbcb472b86ec07911246c
MD5 hash: e956a322a98bc5a641014a0feb79f271
humanhash: uncle-comet-purple-kilo
File name:Fattura.pdf
Download: download sample
File size:226'730 bytes
First seen:2025-05-16 11:50:35 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 6144:Gza0OpMIJI57R3+7d116HpCZNsrg4RAV2vmVYBC:8xO+07Do8Ns04RAV2vmVYM
TLSH T17824E11132E458E1D9CE83F9BDFF01866666C181DD18A2CD7C114B8EE93F41FA167A8D
Magika pdf
Reporter JAMESWT_WT
Tags:1po56mdxc-localto-net AgidCert pdf Spam-ITA

Intelligence

File Origin
# of uploads :
1
# of downloads :
487
Origin country :
IT IT
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PDF.MalwareX-gen.5815.22580.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682726b8e16384d6a704ef1d
Tags:
malware
Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
form macros phishing
Link:
https://www.filescan.io/uploads/682726b3dcf173f136a0929a/reports/d8f2df6f-9bc6-4cb8-8224-552ffc96927f/overview
Verdict:
Malicious
Labled as:
TR/AVI.MalwareX
Link:
https://www.hybrid-analysis.com/sample/db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956
Label:
Malicious
Suspicious Score:
5.1/10
Score Malicious:
52%
Score Benign:
48%
Link:
https://www.malware.ai/gui/files/?id=b5e57aea-f482-4a06-9082-712868f0be76
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1691851
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1691851 Sample: Fattura.pdf Startdate: 16/05/2025 Architecture: WINDOWS Score: 48 43 x1.i.lencr.org 2->43 45 e8652.dscx.akamaiedge.net 2->45 47 7 other IPs or domains 2->47 59 Multi AV Scanner detection for submitted file 2->59 8 chrome.exe 1 2->8         started        11 Acrobat.exe 18 70 2->11         started        13 chrome.exe 14 2->13         started        15 6 other processes 2->15 signatures3 process4 dnsIp5 49 192.168.2.14 unknown unknown 8->49 51 192.168.2.15 unknown unknown 8->51 55 2 other IPs or domains 8->55 17 chrome.exe 8->17         started        20 chrome.exe 8->20         started        22 AcroCEF.exe 106 11->22         started        53 192.168.2.6, 138, 443, 49252 unknown unknown 13->53 24 chrome.exe 13->24         started        process6 dnsIp7 29 142.250.68.228, 443, 49773 GOOGLEUS United States 17->29 31 csp.withgoogle.com 142.250.68.241, 443, 49786, 49787 GOOGLEUS United States 17->31 39 12 other IPs or domains 17->39 33 e8652.dscx.akamaiedge.net 184.28.253.105, 49690, 80 AKAMAI-ASUS United States 22->33 26 AcroCEF.exe 3 22->26         started        35 clients.l.google.com 142.250.69.14, 443, 49699, 49700 GOOGLEUS United States 24->35 37 www.google.com 192.178.49.164, 443, 49707, 49735 GOOGLEUS United States 24->37 41 16 other IPs or domains 24->41 process8 dnsIp9 57 23.202.56.131, 443, 49697 AKAMAI-ASN1EU United States 26->57
Score:
98%
Verdict:
Malware
File Type:
PDF
Link:
https://malprob.io/report/db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956/
Threat name:
Document-PDF.Trojan.Phish
Create hunting rule
Status:
Malicious
First seen:
2025-05-15 05:58:20 UTC
File Type:
Document
Extracted files:
9
AV detection:
13 of 37 (35.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3mlrnrn3rhnbee3hskmscabjlsgacm3sytgry3p6wuxdodhqrfla._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/db1716c5bb89da12136792992100295c8c013372c4cd1c6dfeb52e370cf08956

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments