ORDER_02_881_2021_PDF.exe

Classification: Malicious

ORDER_02_881_2021_PDF.exe is a trojan (application/x-dosexec). Detected by 82 antivirus engines. Linked to Turla activity.

Detection summary

  • 82 antivirus detections
  • 0 IDS alerts
  • 0 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Intrusion sets: TURLA (G0010)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Snake ThreatFox Abuse.ch 2025-02-20 09:38:07 2025-02-22 09:40:05 G0010 Turla
SnakeKeylogger Abuse.ch 2021-12-08 15:32:48 2021-12-08 15:32:48 malicious-activity

Tags

win.snake ekans snakehose

Sample information

Filenames
ORDER_02_881_2021_PDF.exe
File type
application/x-dosexec
MD5
14bd0a33d74a26827abcaa94e069ca1d
SHA-1
25bb7cb48054ad0c862466291de5d9b72feb0991
SHA-256
0b610a34333dfa3576efa2759b6dafd9dbab01105b9a4d870acba55b7d96b5fe
First indexed
2021-12-08 17:15:15
Last updated
2026-09-11 02:24:30

Antivirus detections

EngineDetection
ALYacGen:Variant.Ransom.Loki.8277
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AhnLab-V3Trojan/Win.Generic.C4826073
AlibabaTrojanPSW:MSIL/Tnega.382ffaff
ArcabitTrojan.Ransom.Loki.D2055
AvastWin32:PWSX-gen [Trj]
AviraHEUR/AGEN.1323729
BitDefenderGen:Variant.Ransom.Loki.8277
BkavW32.AIDetectMalware.CS
CAT-QuickHealTrojan.YakbeexMSIL.ZZ4
CTXexe.trojan.msil
ClamAVWin.Ransomware.Aicat-9943273-0
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
DrWebTrojan.Siggen16.2578
ESET-NOD32a variant of MSIL/Kryptik.ADRM
Elasticmalicious (high confidence)
EmsisoftTrojan.Crypt (A)
F-SecureHeuristic.HEUR/AGEN.1323729
FireEyeGen:Variant.Ransom.Loki.8277
FortinetMSIL/Kryptik.ADRS!tr
GDataGen:Variant.Ransom.Loki.8277
GoogleDetected
IkarusTrojan-Spy.AgentTesla
JiangminTrojan.PSW.MSIL.dalz
K7AntiVirusTrojan ( 0058b8ff1 )
K7GWTrojan ( 0058b8ff1 )
KasperskyHEUR:Trojan-PSW.MSIL.Agensla.gen
Kingsoftmalware.kb.c.769
LionicTrojan.Win32.AgentTesla.i!c
MalwarebytesGeneric.Malware.AI.DDS
MaxSecureTrojan.Malware.74499699.susgen
McAfeePWS-FCUF!14BD0A33D74A
McAfeeDti!0B610A34333D
MicroWorld-eScanGen:Variant.Ransom.Loki.8277
MicrosoftTrojan:MSIL/AgentTesla.DRM!MTB
Paloaltogeneric.ml
PandaTrj/GdSda.A
RisingMalware.Obfus/[email protected] (RDM.MSIL2:cEU8xvNn2owaY7BhC8Netw)
SangforSuspicious.Win32.Save.a
SentinelOneStatic AI - Malicious PE
SkyhighPWS-FCUF!14BD0A33D74A
SophosTroj/MSIL-SDM
SymantecMSIL.Packed.19
TencentMsil.Trojan-QQPass.QQRob.Adhl
Trapminesuspicious.low.ml.score
TrendMicroTROJ_FRS.0NA103L921
TrendMicro-HouseCallTROJ_FRS.0NA103L921
VBA32Trojan.MSIL.Taskun
VIPREGen:Variant.Ransom.Loki.8277
VaristW32/MSIL_Agent.CMI.gen!Eldorado
VirITTrojan.Win32.MSIL_Heur.A
XcitiumMalware@#1pm97n7csd7tn
YandexTrojan.Igent.bW5CB1.1
ZillyaTrojan.Kryptik.Win32.3649518
ZonerTrojan.Win32.124176
huorongVirTool/MSIL.Obfuscator.aho
LionicTrojan.MSIL.Taskun.4!c
MicroWorld-eScanTrojan.GenericKD.47599889
FireEyeTrojan.GenericKD.47599889
McAfeeRDN/none
K7AntiVirusRiskware ( 00584baa1 )
K7GWRiskware ( 00584baa1 )
BitDefenderThetaGen:NN.ZemsilF.34084.7q0@aSCo5lm
CyrenW32/MSIL_Agent.CMI.gen!Eldorado
BitDefenderTrojan.GenericKD.47599889
Ad-AwareTrojan.GenericKD.47599889
SophosMal/Generic-S
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKD.47599889 (B)
IkarusTrojan.Inject
MAXmalware (ai score=81)
KingsoftWin32.PSWTroj.Undef.(kcloud)
GDataTrojan.GenericKD.47599889
VBA32TScope.Trojan.MSIL
ALYacTrojan.GenericKD.47599889
MalwarebytesMalware.AI.93142303
SentinelOneStatic AI - Suspicious PE
FortinetPossibleThreat.ZDS
WebrootW32.Trojan.Gen