MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6a8d7b8a80827bd4729cda40e959823c4c30e648a58832623fda8dae20a08ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f6a8d7b8a80827bd4729cda40e959823c4c30e648a58832623fda8dae20a08ab
SHA3-384 hash:	3c4c70d1c5428d90b76f0b3a97035b879e9c6f6da478f4b22c29ef5edd8c86a7dfd386db57e63739c6082816f3236aee
SHA1 hash:	f259653033cb741fa326442c22f58e23f36a047b
MD5 hash:	b81d2ebeb8b0f6ed3e84e78ffe784777
humanhash:	asparagus-coffee-bravo-uniform
File name:	Cancellation_799204_Dec23.pdf
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	186'622 bytes
First seen:	2022-12-23 15:22:51 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	3072:+Qcfk8aPgtSyiVLFkckuQMPhB20K8HR9hYDdfddlRCFwfkFPWN50kNSFHFUmV8NC:58nwhFkZuvPDiYqdfddlVjbr03UmVru4
TLSH	T18F04E0CCB13B76BFE8BB7BB3A562835D374F6525732E6587088992A4C301F42D4510AE
Reporter	pr0xylife
Tags:	obama233 pdf Qakbot qbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

356

Origin country :

US

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilPDF.QakySoWaky.221221.UNOFFICIAL

Alert

Create hunting rule

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PDF File

Link:

https://app.docguard.net/f6a8d7b8a80827bd4729cda40e959823c4c30e648a58832623fda8dae20a08ab/results/dashboard

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

80%

Link:

https://www.filescan.io/uploads/63a5c7d8d701c1ad5367f13b/reports/03474e35-76b0-4bdc-be43-8366e96d92e7/overview

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.0/10

Score Malicious:

9%

Score Benign:

1%

Link:

https://www.malware.ai/gui/files/?id=bd17b22b-980b-494d-aa91-9b20e22ab4df

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Document With Few Pages

Document contains between one and three pages of content. Most malicious documents are sparse in page count.

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1140077

Signature

Clickable URLs found in PDF pointing to potentially malicious files

Found potential malicious PDF (bad image similarity)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6a8d7b8a80827bd4729cda40e959823c4c30e648a58832623fda8dae20a08ab/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=62unpofibat32rzjzwsa5fmyepcmgdterjmigjrd7wunvyqkbcvq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.40

Link:

https://yomi.yoroi.company/submissions/f6a8d7b8a80827bd4729cda40e959823c4c30e648a58832623fda8dae20a08ab