MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e
SHA3-384 hash:	76d022f7dcd5b82be381c3519b3dba9ce9d509c916dcc3ad1e7237ffbec0f5554030571dc99de32b765ad57ba474ed43
SHA1 hash:	a84faef73080e5bb8a28f8c4f8ac9a58cea5f6be
MD5 hash:	d79c7d4f6a038753bbc681176ec83c42
humanhash:	spaghetti-beer-california-alabama
File name:	Purchase Order.pdf
Download:	download sample
File size:	1'402'662 bytes
First seen:	2023-03-28 13:40:31 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	24576:kc/Mf4F+Ec/Mf4F+P49UeU6Y9pv3yFC5dlTwdY9YS36SX/h2SUo0u++w:kc/Mo+Ec/Mo++vUHX3yo5dlsdY9Yonv4
TLSH	T1E355E0039C044A87E42983F4BF075EAE2B19375DE9923AEF15275EDF3E602511C9E12E
Reporter	c_APT_ure
Tags:	pdf

c_APT_ure

embedded office file
"has been verified. However IMG, PDF, doc, .xls"

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

380

Origin country :

CH

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

PUA.Win.Trojan.EmbeddedPDF-1

Alert

Create hunting rule

Sanesecurity.Badmacro.Xls.Msg.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Badmacro.Xls.Msg2.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20221124-0821.MacroImg.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20230314-1327.DocImg.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Shelter.Malware.BadMacro.BadOleNatEquat.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.EQAndMisCasedOleNativeWasTheCaseThatTheyGaveMe.20200215.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

PDF File

Link:

https://app.docguard.net/f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

86%

Tags:

embedequation exploit macros shellcode

Link:

https://www.filescan.io/uploads/6422ee7339ca37cf45d04409/reports/713cbe66-757a-49de-b2fd-3a4def5453ca/overview

Hybrid Analysis CVE-2018-0802

Verdict:

Malicious

Labled as:

CVE-2018-0802

Link:

https://www.hybrid-analysis.com/sample/f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

5.1/10

Score Malicious:

52%

Score Benign:

48%

Link:

https://www.malware.ai/gui/files/?id=7684e71a-9410-41f0-aea1-8077c244770f

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/1203479

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Document exploit detected (process start blacklist hit)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e/

ReversingLabs TitaniumCloud Win32.Exploit.CVE-2017-11882

Threat name:

Win32.Exploit.CVE-2017-11882

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-03-28 13:41:11 UTC

File Type:

Document

Extracted files:

159

AV detection:

12 of 23 (52.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6lr67krhtkdl7mxytu5b52mbrd5io6kmtlrg4qcui2teqdf6oe7a._file

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f2e3efaa279a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f2e3efaa279a86bfb2f89d3a1ee98188fa87794c9ae26e405446a6480cbe713e