MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435
SHA3-384 hash:	755939629b217dd385f5a4541b841702963186c5b09454a937012bdaf658aac17431c251c066f2f2090e9f6c99d0b790
SHA1 hash:	e235511406047303da86401be08fc56747b31b0a
MD5 hash:	d6b61fdb6de92bb6a9bd896232a64232
humanhash:	paris-triple-vermont-kilo
File name:	M.pdf
Download:	download sample
Signature	DarkGate Alert Create hunting rule
File size:	22'740 bytes
First seen:	2023-10-10 10:44:57 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	384:Vf2qLD4mWRzERxWIDtAWYCJndLQUHYUfCT6jtwAzrsFA1nYNJj2/haWa92qZluPo:h2qfLSdIDVRntQCwmrd1Y/G+BlAZ8XkG
TLSH	T1F1A2C0367E2D3045F086DC2DFE6EB69E469ABA0347EC53D1185E6C0A7448604F683BB7
Reporter	JAMESWT_WT
Tags:	DarkGate pdf stolenconversation

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

506

Origin country :

IT

Vendor Threat Intelligence

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435/results/dashboard

FileScan.io

Gathering data

Hybrid Analysis Pdf/malicious_confidence_90%

Verdict:

Malicious

Labled as:

Pdf/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

1.6/10

Score Malicious:

17%

Score Benign:

83%

Link:

https://www.malware.ai/gui/files/?id=817d9425-1dff-4ac5-aacd-499029e81dc0

Joe Sandbox DarkGate, MailPassView

Result

Threat name:

DarkGate, MailPassView

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1322772

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Contains functionality to modify clipboard data

Deletes shadow drive data (may be related to ransomware)

Downloads suspicious files via Chrome

Found malware configuration

Multi AV Scanner detection for domain / URL

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Yara detected DarkGate

Yara detected MailPassView

Yara detected WebBrowserPassView password recovery tool

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435/

ReversingLabs TitaniumCloud Document-PDF.Trojan.DarkGate

Threat name:

Document-PDF.Trojan.DarkGate

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-10 10:45:05 UTC

File Type:

Document

Extracted files:

3

AV detection:

12 of 22 (54.55%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7e75slio2sg4t5dmwoq5q3gxbbb54xfjqxxcrr3466itcdmw6q2q._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/f93fd92d0ed48dc9f46cb3a1d86cd70843de5ca985ee28c77cf791310d96f435