MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a
SHA3-384 hash:	5bc92d091c981d798f7a5eadb61f143e2e8c3c833c772e667ca0e5317496b7854cecf04331d283b2c1b7598728222019
SHA1 hash:	6dc32cadf2c5c5a0815f05cf43e0aa89aa845253
MD5 hash:	2910c69c45e44239a8c818a79d98352a
humanhash:	butter-bluebird-kilo-carpet
File name:	Request for Quotation - PR10068289.wsf
Download:	download sample
File size:	5'981 bytes
First seen:	2026-11-11 07:06:08 UTC
Last seen:	Never
File type:	WSF
MIME type:	text/xml
ssdeep	48:xTzb2j2fijLBFIWPfR6II+PJjBFO1+JptVXJWQCT0YnUwHDwisxxsFq+4:xT9yBFxhfhjBFOClYHAYUwV4xsFc
TLSH	T136C1208A2DCE60518637F37A8F2F520DF722852B0146C5597A8DA3910F3182543ACFFD
TrID	62.5% (.XML) Generic XML (ASCII) (5000/1) 37.5% (.HTML) HyperText Markup Language (3000/1/1)
Magika	txt
Reporter	lowmal3
Tags:	wsf

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af413e4beffd05f052b088e

Tags:

proxy rapid java

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

DNS request

Connection attempt

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive powershell

Link:

https://www.filescan.io/uploads/6af413e1e92e087955099e72/reports/e2a851b9-6b38-4974-9a9a-ee793d0e4470/overview

Hybrid Analysis JS/TrojanDownloader.Agent

Verdict:

Malicious

Labled as:

JS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

wsf

Link:

https://opentip.kaspersky.com/113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/2003921

Signature

Multi AV Scanner detection for submitted file

Sigma detected: Script Initiated Connection to Non-Local Network

System process connects to network (likely due to code injection or exploit)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a

Malva.RE Malware

Verdict:

Malware

YARA:

5 match(es)

Tags:

Html Javascript JS Emulation Trace MSXML2.XMLHTTP PowerShell Scripting.FileSystemObject T1059.007 T1105 WScript.Shell WSF File

Link:

https://app.malva.re/file/2910c69c45e44239a8c818a79d98352a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a/

ReversingLabs TitaniumCloud Script-JS.Backdoor.FormBook

Threat name:

Script-JS.Backdoor.FormBook

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-11-11 07:07:15 UTC

File Type:

Text (XML)

Extracted files:

1

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ce55hetb6fvizimowvyhlvwasas3z7wv4ktwz2ryhhd3dgmhefva._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery execution

Link:

https://tria.ge/reports/261111-hw6jlsfc73/

Behaviour

Reads the TCP/IP host and domain name from the registry

Executes a VBScript file via the Windows Script Host.

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/113bd39261f16a8ca18eb57075d6c09025bcfed5e2a76cea3839c7b19987216a