Order_001-882-2021_pdf.exe
Classification: Malicious
Order_001-882-2021_pdf.exe is an infostealer (application/x-dosexec). Detected by 19 antivirus engines. Linked to Turla activity.
Detection summary
- 19 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Intrusion sets: TURLA (G0010)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Snake | ThreatFox Abuse.ch | 2025-02-20 09:40:46 | 2025-02-22 09:25:20 | G0010 Turla | |
| SnakeKeylogger | Abuse.ch | 2021-12-08 15:32:50 | 2021-12-08 15:32:50 | malicious-activity |
Tags
win.snake ekans snakehoseSample information
- Filenames
- Order_001-882-2021_pdf.exe
- File type
- application/x-dosexec
- MD5
c342f3db03eebaf41c9bb191926a98c5- SHA-1
2c2e8005414fefcf5a1bad46a113810cd6911a38- SHA-256
23ee088ad3fd50299a52cec2cb5f3dad33efe14b9c66cbbc9a2f558178c261de- First indexed
- 2021-12-08 17:15:15
- Last updated
- 2026-09-11 02:24:30
Antivirus detections
| Engine | Detection |
|---|---|
| McAfee | Artemis!C342F3DB03EE |
| Cylance | Unsafe |
| Alibaba | Trojan:Win32/Kryptik.ali2000016 |
| Symantec | MSIL.Packed.19 |
| ESET-NOD32 | a variant of MSIL/GenKryptik.FOOK |
| TrendMicro-HouseCall | TrojanSpy.MSIL.NEGASTEAL.SMG |
| Paloalto | generic.ml |
| Kaspersky | HEUR:Trojan-PSW.MSIL.Stealer.gen |
| Emsisoft | Trojan.PasswordStealer.GenericKDS.47598873 (B) |
| TrendMicro | TrojanSpy.MSIL.NEGASTEAL.SMG |
| McAfee-GW-Edition | Artemis |
| SentinelOne | Static AI - Suspicious PE |
| Sophos | Mal/Generic-S |
| APEX | Malicious |
| Microsoft | Trojan:Win32/Woreflint.A!cl |
| AhnLab-V3 | Trojan/Win.Infostealer.R456991 |
| Malwarebytes | Trojan.MalPack.ADC |
| Ikarus | Trojan.Inject |
| Fortinet | Malicious_Behavior.SB |