🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13
SHA3-384 hash: f6bcf704f329929d1d00841cae79ad7a47b4c66e238b3044bec65aa9b29d1fa9b623b56ee5487c86492090ce6987e9f0
SHA1 hash: 46ce8e54e5b8b558f99e6d9ee257f01d51be1f6a
MD5 hash: 67db60f80efa8820633911b3ada48275
humanhash: yankee-beer-jig-mountain
File name:Order.pdf
Download: download sample
Signature AgentTesla
Create hunting rule
File size:144'425 bytes
First seen:2022-05-13 12:27:00 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 1536:+J7RR9YcESpN6ynhzN7Wuy5j7JKvg4pt1lJJ1O/6Sj1PESNHlCaHgqJhXkgq0w+c:E7RRyEplLWuQvgvg4P172/XbtC+c
TLSH T148E3AE6C58E5B484027DABA077C095E7CC9B13AB9D885C2BB19E8F971F01ED2DD43683
Reporter ankit_anubhav
Tags:AgentTesla pdf

Intelligence

File Origin
# of uploads :
1
# of downloads :
566
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Suspicious
File Type:
PDF File
Link:
https://app.docguard.net/e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/627e4ed4804c0977d3eaf608/reports/7a265142-8c15-46ef-86f3-c4a5cfeda78b/overview
Label:
Benign
Suspicious Score:
2.2/10
Score Malicious:
23%
Score Benign:
77%
Link:
https://www.malware.ai/gui/files/?id=5382f7b1-069e-4982-a070-ae5e19709b12
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/993543
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626039 Sample: Order.pdf Startdate: 13/05/2022 Architecture: WINDOWS Score: 48 28 dhqbrvplips7x.cloudfront.net 2->28 44 Multi AV Scanner detection for submitted file 2->44 8 AcroRd32.exe 15 43 2->8         started        signatures3 process4 process5 10 RdrCEF.exe 62 8->10         started        13 chrome.exe 15 229 8->13         started        15 AcroRd32.exe 10 7 8->15         started        dnsIp6 36 192.168.2.1 unknown unknown 10->36 17 RdrCEF.exe 10->17         started        19 RdrCEF.exe 10->19         started        21 RdrCEF.exe 10->21         started        23 RdrCEF.exe 10->23         started        38 239.255.255.250 unknown Reserved 13->38 25 chrome.exe 18 13->25         started        40 usw2.pure.cloud 15->40 42 pure.cloud 15->42 process7 dnsIp8 30 clients.l.google.com 142.250.185.206, 443, 49730, 55357 GOOGLEUS United States 25->30 32 accounts.google.com 142.250.186.77, 443, 49726 GOOGLEUS United States 25->32 34 7 other IPs or domains 25->34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13/
Threat name:
Document-PDF.Phishing.PhishingX
Create hunting rule
Status:
Malicious
First seen:
2022-05-13 12:28:07 UTC
File Type:
Document
Extracted files:
57
AV detection:
5 of 41 (12.20%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

pdf e404a4fef8a30815cdf6805f18c0022df2255d63e03bbce4da13ab9e0687fa13

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments