MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 030d86460a858d1eea6bfa32f2029aec2d20bb7cd8afaca1d2386a413a136a9e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 8
| SHA256 hash: | 030d86460a858d1eea6bfa32f2029aec2d20bb7cd8afaca1d2386a413a136a9e |
|---|---|
| SHA3-384 hash: | 9b61f55b1cc3fa19eaf0eb8d4feac053ecdda154c2166d902aca4a3847fa8ad3032b9b873feed0954bb536487a754e55 |
| SHA1 hash: | 795511f31c9a5b420c99160158167eb483402efe |
| MD5 hash: | 238f968214bf8174b90c6c4ea931b612 |
| humanhash: | spring-south-pizza-burger |
| File name: | Payment_receipt20kX.rar |
| Download: | download sample |
| File size: | 6'636 bytes |
| First seen: | 2026-07-24 12:15:01 UTC |
| Last seen: | 2026-07-24 12:40:55 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 192:VGH2jZ5LksJNvBw+AQ7zxIl30cIyTTTp47baGm:M2LLks7JXDzg0cvTTp4Cn |
| TLSH | T1BBD19F4F24CB42F702B6A37B3C910447E556B80BA417C747F6E22D79BE0EA865560E8C |
| TrID | 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1) |
| Magika | rar |
| Reporter |  TomU |
| Tags: | rar |
Intelligence
File Origin
# of uploads :
4
# of downloads :
33
Origin country :
CHFile Archive Information
This file archive contains 1 file(s), sorted by their relevance:
| File name: | Payment_receipt20k$.js |
|---|---|
| File size: | 46'185 bytes |
| SHA256 hash: | 46bb4585a2d85b325ebc69245e373262a9de2c7a8eb552835026e2ccef140a21 |
| MD5 hash: | 16299e4c749b1c5bfbfaacc521ff3c85 |
| MIME type: | text/plain |
Vendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm fingerprint masquerade repaired
Verdict:
Malicious
Labled as:
HEUR/Suspar.Generic
Verdict:
Malicious
File Type:
rar
First seen:
2026-07-14T02:00:00Z UTC
Last seen:
2026-07-14T02:04:00Z UTC
Hits:
~10
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Rar Archive
Threat name:
Binary.Trojan.Generic
Status:
Suspicious
First seen:
2026-07-14 06:24:07 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
10/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Executes a command shell one-liner
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
rar 030d86460a858d1eea6bfa32f2029aec2d20bb7cd8afaca1d2386a413a136a9e
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.