MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6
SHA3-384 hash:	38d91a5513d9290acdb6825ca18234b8f59eea1b60d02fe5f172c2fea2f12ccab50b1fe252757154c9bed670e192d7d9
SHA1 hash:	b4b25aaaf07f4678688cefc4344a9f078f5e49b8
MD5 hash:	f2406ac5774b95505b3d587465b2740d
humanhash:	fix-yellow-yankee-crazy
File name:	lnvoice_1541436948.pdf
Download:	download sample
File size:	16'795 bytes
First seen:	2023-09-18 12:00:14 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	384:grfVsuD4nuVC2GGGGzoTLb1zM7cfZsOvcAQd7+DA/:grGKC2GGGGz8b1zEcjvcRFsA/
TLSH	T1AB726E2CAF399055F4560F7B021C2747D0AE93D16768657E292F4586BC0BE24EF2C3E6
Reporter	JAMESWT_WT
Tags:	AgentTesla htlbookingnew pdf TUKHAMTASSER

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

428

Origin country :

IT

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.HEUR.Trojan.PDF.Meme.gen.6501.25027.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

PDF File

Link:

https://app.docguard.net/faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6/results/dashboard

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

88%

Link:

https://www.filescan.io/uploads/65083bff43cd377b1e9f539a/reports/91d5411e-ebf0-4f57-b0c9-c23879a0569a/overview

Hybrid Analysis Trojan.PDF.Meme

Verdict:

Malicious

Labled as:

Trojan.PDF.Meme

Link:

https://www.hybrid-analysis.com/sample/faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

6.4/10

Score Malicious:

64%

Score Benign:

36%

Link:

https://www.malware.ai/gui/files/?id=629a4af8-3cb9-42f4-8f98-3effae4158c1

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.expl

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1309987

Signature

Connects to many IPs within the same subnet mask (likely port scanning)

Downloads suspicious files via Chrome

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suspicious execution chain found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6/

ReversingLabs TitaniumCloud Document-PDF.Trojan.Heuristic

Threat name:

Document-PDF.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-09-18 06:05:38 UTC

File Type:

Document

Extracted files:

9

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7ksrututezn22vx2jphmtpgjndlncgylfma3y7mcz7xdwmsagh3a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/faa51a4e93265bad56fa4bcec9bcc968d6d11b0b2b01bc7d82cfee3b324031f6