MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e04684718b551c6e242a8e0f85bc812f14c67a64d2e03bb78c8b21e7a73bf40c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e04684718b551c6e242a8e0f85bc812f14c67a64d2e03bb78c8b21e7a73bf40c
SHA3-384 hash:	9c0aeb4c3b42f6da7bbe997b9f3c5d7c795e86467413a205b0c844cca2f6fd447c6e8ebf5d50b59986c357debf1cf109
SHA1 hash:	452b9be2b64778fc14648ca15b1a0c849848b6c8
MD5 hash:	69b2fd554e7ab49e66f8cbde20f9ed67
humanhash:	zulu-blue-king-orange
File name:	0_IT08642305341_83_26042023_044000.pdf
Download:	download sample
Signature	Gozi Alert Create hunting rule
File size:	76'333 bytes
First seen:	2023-04-28 06:31:09 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:O+fgxo0Su49PBYZ8f7kpq7shHbMA5ETEiPtwDuuY6m24REIE:pAok49eg7kpq7sVMLTzV8G3P8
TLSH	T10973CF5CD15BD045D94BCADAFF59BDE2218CF722A2E85C91327E0EC29B91EF0B12D112
Reporter	JAMESWT_WT
Tags:	DhlCredit Gozi pdf Ursnif

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

448

Origin country :

IT

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/e04684718b551c6e242a8e0f85bc812f14c67a64d2e03bb78c8b21e7a73bf40c/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/644b68623d47a64d306b399c/reports/1478dd57-931f-470f-849d-69a749ef6273/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e04684718b551c6e242a8e0f85bc812f14c67a64d2e03bb78c8b21e7a73bf40c

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

/10

Score Malicious:

1%

Score Benign:

99%

Link:

https://www.malware.ai/gui/files/?id=8e1ed8d1-fe15-408e-aa73-2a5b8a8f9eda

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1222607

Signature

Multi AV Scanner detection for domain / URL

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e04684718b551c6e242a8e0f85bc812f14c67a64d2e03bb78c8b21e7a73bf40c/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Ursinf

Threat name:

Document-PDF.Trojan.Ursinf

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-27 10:43:55 UTC

File Type:

Document

Extracted files:

8

AV detection:

2 of 37 (5.41%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4bdii4mlkuog4jbkryhylpebf4kmm6te2lqdxn4mrmq6pjz36qga._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.