🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb
SHA3-384 hash: 0587a24772d8e5ceb2bb88ab46d0f06ac944e934b979100cfd107c8b7c244aa6bae688224f7859b4d0da81456038ceff
SHA1 hash: 791862cae203f32d08832931b6a040d924c1ad75
MD5 hash: 3009d195b5ffe3c87dbd168dfe658603
humanhash: eleven-eighteen-red-summer
File name:Humanitarian assistance indicators_ displacement and support metrics.zip
Download: download sample
File size:47'135 bytes
First seen:2026-10-22 14:48:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:5CAdya0bLPp66ouuYSpXubY1yuNyGEH1mP1oEprb1qz27Ruyvuw:n8z06ouu/5ubPuNHEVmNtV1h9d2w
TLSH T1EB23F1160D52DA401A1EDB30B47E6F07EBAA521F983C3A8D6C2FF0C167A1725C74629F
Magika zip
Reporter smica83
Tags:CVE-2026-42897 zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
160
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/43b0dc93-4e63-4cc1-ae94-59728c4571c9/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ada22705a22ac805bd9add9
Tags:
n/a
Result
Verdict:
Malicious
File Type:
HTML File - Malicious
Link:
https://app.docguard.net/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/6ada226a19704103e4f02d97/reports/650d6d8a-c663-443f-a79d-9e1d81dd0a02/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb
Verdict:
Malicious
File Type:
zip
Link:
https://opentip.kaspersky.com/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb/results?tab=lookup
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Zip Archive ❌ DKIM invalide
Link:
https://app.malva.re/file/3009d195b5ffe3c87dbd168dfe658603
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb/
Threat name:
Document-HTML.Exploit.CVE-2026-42897
Create hunting rule
Status:
Malicious
First seen:
2026-10-22 14:49:21 UTC
File Type:
Binary (Archive)
Extracted files:
160
AV detection:
5 of 38 (13.16%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a67jdsmml7xocypipua76ldbpmzexlv3lifw5234rceqbljvrc5q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/261022-s5f1es11bt/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/07be91c98c5feee161e87d01ff2c617b324baebb5a0b6eeb7c888900ad3588bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:without_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any url
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments