MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626
SHA3-384 hash:	2c439c50fad20699daa6d3160f6b0c86154af48b07174c9b4182745475bd0608e26aeb958d13de19aae8241ea20d4d95
SHA1 hash:	4d8b035279dd2b565c457d2cf09911b653642a54
MD5 hash:	7e49bac468548a0e83133f0d5b02544b
humanhash:	alabama-sweet-quiet-earth
File name:	PO-O129867-0721_Issued.pdf.txz.rar
Download:	download sample
Signature	PureLogsStealer Alert Create hunting rule
File size:	371'653 bytes
First seen:	2026-07-24 12:44:57 UTC
Last seen:	2026-07-29 12:09:11 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:73jn0SN5o2WYCqhGe9ILbcAFMn/bxibxrEyzdrXBVWFKJP9/y7TFY2exxH1eNA:jr5NrJeI8QAmnjxibX57WwJxyO2exx0m
TLSH	T1B5842319D06CE192253A4F1DBF24DF9BF7259F583EBDC61904C89E160FACF34021A999
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	PureLogsStealer rar

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

68

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	PO-O129867-0721_Issued.js
File size:	1'558'650 bytes
SHA256 hash:	0826368434cbe294a9dd842f70a0f7e25367d0319179ca9bc9d7f13fb74ab9d1
MD5 hash:	4b3a16ad9e1e502aae805211f2bd25a7
MIME type:	text/plain
Signature	PureLogsStealer

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5e900902-ab21-49b0-85d4-680a73b17386/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd conhost downloader expand lolbin powershell repaired

Link:

https://www.filescan.io/uploads/6a635e6ec0b4575d45bbf6bc/reports/d87bc813-99e1-4a56-a457-cafb1a9fc817/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-23T07:11:00Z UTC

Last seen:

2026-07-26T06:54:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/7e49bac468548a0e83133f0d5b02544b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-22 14:01:23 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dtm6jco2pvnfiorbsrmnmd5oo5gdy53rullaxpr2mil3x6h34yta._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

collection discovery execution persistence

Link:

https://tria.ge/reports/260724-p4kens1ane/

Behaviour

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Browser Information Discovery

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

System Time Discovery

Accesses Microsoft Outlook profiles

Checks computer location settings

Registers new Windows logon scripts automatically executed at logon.

Badlisted process makes network request

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1cd9e489da7d5a543a219458d60fae774c3c7771a2d60bbe3a6217bbf8fbe626