MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e
SHA3-384 hash:	ee652dca32296f8e903138d297c548574a8d030270aeb8229fd9176f158b4611d37370fbb0d3684629f3cf82212a9f76
SHA1 hash:	81e138c0abbbedbb9b50e8181df8f99203f922b4
MD5 hash:	5e8092fb2a42c2c5d01f0de21c22597f
humanhash:	illinois-red-crazy-romeo
File name:	sit.pdf
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	52'805 bytes
First seen:	2023-04-26 04:44:03 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	1536:5M9HOLi5vNxDhLoR10PN56U8rv5Nua/2kE2g9:Y+CvNxDmRSN56maa9
TLSH	T14F33F1FAD5A8CDC4B9C7D465827E332AC158F508B8CE24C501179DA79E80CBFBA983D5
Reporter	Jazzo74911657
Tags:	pdf Qakbot qbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

502

Origin country :

DE

Vendor Threat Intelligence

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

remote

Link:

https://www.filescan.io/uploads/6448ac4f19db59e4586271c7/reports/6fbc35c8-2fc3-44d1-9ccf-a7b7f0a21687/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.6/10

Score Malicious:

96%

Score Benign:

4%

Link:

https://www.malware.ai/gui/files/?id=1c47e64b-4231-4164-be44-a1e7e524193d

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1221196

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Downloads suspicious files via Chrome

Machine Learning detection for sample

Suspicious execution chain found

System process connects to network (likely due to code injection or exploit)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Heuristic

Threat name:

Document-PDF.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-04-25 18:57:07 UTC

File Type:

Document

Extracted files:

3

AV detection:

4 of 36 (11.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4zktgkte4tskymsgk5embkirvpdv666knvsvwv6nvtfg2bkibe7a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e655332a64e4e4ac32465748c0a911abc75f7bca6d655b57cdacca6d0548093e