MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765
SHA3-384 hash:	f6c3b4e0b64c82097bea24cd400049374633b1c72dbb2f47157377c9b03e88c9b64e4e14a7cdd8087036d19a5eef4355
SHA1 hash:	f7e44017b482885edda87c91e2141df7ddd9daca
MD5 hash:	7ea677508ce9ed7d252b47ac4669c976
humanhash:	equal-autumn-ten-avocado
File name:	DOC757869856647.pdf
Download:	download sample
Signature	STRRAT Alert Create hunting rule
File size:	433'613 bytes
First seen:	2023-10-30 12:18:08 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	12288:NYymYsSNo2kyK9jAnVqh0koUZoRdkprZ7W:TDNo2fVqChYQae
TLSH	T1629423E15204DCC3E8725525B987712F8FB44122A0D92BEB2BE228D806B5E91D71E7DF
Reporter	reecdeep
Tags:	pdf STRRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

554

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.PDF.PhishingX-gen.20756.14124.UNOFFICIAL

Alert

Create hunting rule

DocGuard Clean

Result

Verdict:

Clean

File Type:

PDF File

Link:

https://app.docguard.net/fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

phishing

Link:

https://www.filescan.io/uploads/653f9f36a6fa5eab936aac89/reports/3968a646-ae73-421e-8451-5a371979445d/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765

inlyse Malware.AI Benign

Label:

Benign

Suspicious Score:

2.3/10

Score Malicious:

24%

Score Benign:

76%

Link:

https://www.malware.ai/gui/files/?id=431b35f0-eb82-4612-8cd1-6aa9e7bb09ba

Joe Sandbox STRRAT

Result

Threat name:

STRRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.expl.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1334220

Signature

Antivirus detection for URL or domain

Clickable URLs found in PDF pointing to potentially malicious files

Found malware configuration

Found suspicious ZIP file

Malicious sample detected (through community Yara rule)

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Yara detected AllatoriJARObfuscator

Yara detected STRRAT

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765/

ReversingLabs TitaniumCloud Document-PDF.Phishing.Generic

Threat name:

Document-PDF.Phishing.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-10-30 08:13:29 UTC

File Type:

Document

Extracted files:

6

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7iyfuhrtjre7q6gov4xgfeordmxnboeecyehe5blshabckr4c5sq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI STRRAT

Threat name:

STRRAT

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fa305a1e334c49f878ceaf2e6291d11b2ed0b884160872742b91c0112a3c1765