🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ece249202609ac40f5bb35a70d9ddfe8eed005fb5a7941f37a783929bbcb318f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ece249202609ac40f5bb35a70d9ddfe8eed005fb5a7941f37a783929bbcb318f
SHA3-384 hash: 0bce1efba3acbfa05b4db5f1f8e27e53ee063cef3802dc189a882762772b9d11fe7d753c89e2b1b6abffd8fabb363b5d
SHA1 hash: ce355b54c148ea9407cb8daff00d598efb41d3af
MD5 hash: 4b06ad44085a980131b8cc98b8da9c51
humanhash: one-lithium-fruit-tennis
File name:ice.txt
Download: download sample
File size:64'903 bytes
First seen:2026-11-11 23:33:52 UTC
Last seen:Never
File type: pdf
MIME type:application/pdf
ssdeep 1536:qWWHYO5UtQH7NSBcExM2GjdBroP6/KXZJ0vKCeSWENLfsdl0y:EYoeR+dBruotKCeSWQgD0y
TLSH T11D5302ABC999BFCDE0C6D10F0CD93D66381E3683A8B4875139BD8E631B16E521F47129
Magika pdf
Reporter Anonymous
Tags:pdf


Avatar
Anonymous
a

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
PE PE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af4fb76c48f25399eb5420b
Tags:
extens
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a service
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
encrypted form masquerade
Link:
https://www.filescan.io/uploads/6af4fb731dca8453c90bb27d/reports/4fb8a2dd-70e4-4b45-a9de-8f7a491cfcd7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ece249202609ac40f5bb35a70d9ddfe8eed005fb5a7941f37a783929bbcb318f
Label:
Benign
Suspicious Score:
2.1/10
Score Malicious:
21%
Score Benign:
79%
Link:
https://www.malware.ai/gui/files/?id=0d6cf2a9-71de-413a-bbb5-f322cdec112b
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
22 / 100
Link:
https://www.joesandbox.com/analysis/2004322
Signature
PDF is encrypted and contains forms
Behaviour
Behavior Graph:
Download SVG
Verdict:
inconclusive
YARA:
3 match(es)
Link:
https://app.malva.re/file/4b06ad44085a980131b8cc98b8da9c51
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ece249202609ac40f5bb35a70d9ddfe8eed005fb5a7941f37a783929bbcb318f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5tresibgbgweb5n3gwtq3ho75dxnabp3lj4ud432pa4sto6lgghq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ece249202609ac40f5bb35a70d9ddfe8eed005fb5a7941f37a783929bbcb318f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments