MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b
SHA3-384 hash:	23f03912440f13b29b8801fedb1db23072d2e58c2bc4c9fd6a3fdab838b6f942337c381bd8426d1af4b4daf4347430ac
SHA1 hash:	990bf81b0fdc4319a0648d07b94102003327a4cb
MD5 hash:	963090fccb0cb304e5e7f03a55d517ea
humanhash:	crazy-gee-ink-mountain
File name:	PO _no1DSQV00013019.vbs
Download:	download sample
File size:	298'038 bytes
First seen:	2026-08-19 13:38:37 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	6144:JQCEvYYnzAX3Rnodeay88kwqBV7BuyGWiMvWyTfBN2rJYp+nR9F:JuPkhodsWBypyTBNUnR9F
TLSH	T1E3544B3DB0BDD766ECA0026816A2C741053AD4C010A877747FEF6C9DF3B859966A239F
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	winregistry
Reporter	threatcat_ch
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/81992/

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a85b20d3316d8e4d70332e0/reports/313307db-5971-4f93-9bbc-8ef53fb63887/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

22 / 100

Link:

https://www.joesandbox.com/analysis/1960386

Signature

Sigma detected: WScript or CScript Dropper

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

24%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated T1027 T1059.005 VBScript

Link:

https://app.malva.re/file/963090fccb0cb304e5e7f03a55d517ea

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Heuristic

Threat name:

Script-WScript.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-19 14:15:02 UTC

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cy2b7mfejls2wegnbe3sj4dvcbxwk3rxj6xxrlwvybxsh2ivvknq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  5/10

Tags:

execution

Link:

https://tria.ge/reports/260819-qx66javgla/

Behaviour

Executes a VBScript file via the Windows Script Host.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

vbs 16341fb0a44ae5ab10cd093724f075106f656e374faf78aed5c06f23e915aa9b

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/81992/