doc2022031001001.pdf.exe
Classification: Malicious
doc2022031001001.pdf.exe is a trojan (application/x-dosexec). Detected by 59 antivirus engines. Linked to Turla activity. 3 sightings, last seen 2025-02-22.
Detection summary
- 59 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:39:39 | 2025-02-22 09:31:27 | G0010 Turla | |
| SnakeKeylogger | MalwareBazaar Abuse.ch | 2022-05-30 07:35:56 | 2022-05-30 07:35:56 | malicious-activity | |
| Generic.Malware | MalwareBazaar Abuse.ch | 2022-05-30 07:35:56 | 2022-05-30 07:35:56 | malicious-activity |
Tags
win.snake ekans snakehoseSample information
- Filenames
- doc2022031001001.pdf.exe
- File type
- application/x-dosexec
- MD5
ba3415a2abed63ed04df93ba8f1e2f23- SHA-1
0785eeb033c79ae495842a14d662a77ce6227543- SHA-256
19a13e75ded35870ee28b0257227b54d34fc4db31da4cd46ae2e8930adda0915- First indexed
- 2022-05-30 09:15:12
- Last updated
- 2026-09-15 17:54:15
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Trojan.Keylogger.Snake |
| APEX | Malicious |
| AVG | Win32:PWSX-gen [Trj] |
| AhnLab-V3 | Trojan/Win.MSILKrypt.R494927 |
| Alibaba | TrojanSpy:MSIL/SnakeKeylogger.04016f10 |
| Arcabit | Trojan.Generic.D25FCF62 |
| Avast | Win32:PWSX-gen [Trj] |
| Avira | HEUR/AGEN.1324081 |
| BitDefender | Trojan.GenericKD.39833442 |
| Bkav | W32.Common.79D98902 |
| CAT-QuickHeal | Trojan.YakbeexMSIL.ZZ4 |
| CTX | exe.trojan.msil |
| ClamAV | Win.Trojan.Generic-10023218-0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cylance | Unsafe |
| DeepInstinct | MALICIOUS |
| DrWeb | Trojan.Siggen17.60073 |
| ESET-NOD32 | a variant of MSIL/Kryptik.AFHA |
| Elastic | malicious (high confidence) |
| Emsisoft | Trojan.GenericKD.39833442 (B) |
| F-Secure | Heuristic.HEUR/AGEN.1324081 |
| FireEye | Generic.mg.ba3415a2abed63ed |
| Fortinet | MSIL/GenKryptik.FVTU!tr |
| GData | Trojan.GenericKD.39833442 |
| Detected | |
| Ikarus | Trojan.MSIL.Agent |
| Jiangmin | Trojan.MSIL.amvmp |
| K7AntiVirus | Trojan ( 00593a221 ) |
| K7GW | Trojan ( 00593a221 ) |
| Kaspersky | HEUR:Trojan-Spy.MSIL.Noon.gen |
| Kingsoft | malware.kb.c.826 |
| Lionic | Trojan.Win32.Noon.l!c |
| Malwarebytes | Malware.AI.4196544781 |
| MaxSecure | Trojan.Malware.73691310.susgen |
| McAfee | PWS-FDLQ!BA3415A2ABED |
| McAfeeD | ti!19A13E75DED3 |
| MicroWorld-eScan | Trojan.GenericKD.39833442 |
| Microsoft | Trojan:MSIL/SnakeKeylogger.KA!MTB |
| NANO-Antivirus | Trojan.Win32.Noon.jphbox |
| Paloalto | generic.ml |
| Panda | Trj/GdSda.A |
| Rising | Malware.Obfus/[email protected] (RDM.MSIL2:ANw9qlTntpPScKZqthkqsQ) |
| Sangfor | Suspicious.Win32.Save.pkr |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Generic.jc |
| Sophos | Mal/Generic-S |
| Symantec | ML.Attribute.HighConfidence |
| Tencent | Malware.Win32.Gencirc.13b88a93 |
| TrendMicro | TROJ_GEN.R002C0DKM24 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DKM24 |
| VBA32 | Trojan.MSIL.Taskun |
| VIPRE | Trojan.GenericKD.39833442 |
| Varist | W32/MSIL_Kryptik.HIR.gen!Eldorado |
| ViRobot | Trojan.Win.Z.Agent.614400.HO |
| Xcitium | Malware@#v4jud4ivh8u2 |
| Yandex | Trojan.Igent.bX5Nc8.13 |
| Zillya | Trojan.Kryptik.Win32.3776876 |
| Zoner | Trojan.Win32.137671 |
| huorong | TrojanSpy/MSIL.AgentTesla.bz |