🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d
SHA3-384 hash: 7bcc2da42019f9b26da1d40811ec8af0d550762e2fe6af25f84954ecbd7764fd9b7901e80534aa65edd94507d043ee4f
SHA1 hash: 28f5f74c3916cb40412e9a8f80c484f5f0b682d4
MD5 hash: 06a7ff3ad60580c222780b1c3ca8db15
humanhash: hotel-apart-arkansas-two
File name:Contracts_doc.vbs
Download: download sample
File size:2'840'337 bytes
First seen:2026-04-15 17:27:40 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:application/octet-stream
ssdeep 192:epGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGopGS:iD
TLSH T1D3D5707962B6CB4DF681B723D0738A9F67ED6017E28B2FD35D98636109084F2857E8C4
Magika txt
Reporter James_inthe_box
Tags:exe vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61787/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69dfcb2bf68adfe1003a2673
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm fingerprint masquerade obfuscated powershell
Link:
https://www.filescan.io/uploads/69dfd5d75ea31bc68a2ddff1/reports/f6cd3316-516f-4724-8320-298cb4f491a1/overview
Verdict:
Malicious
Labled as:
VBS/Agent.CRE
Link:
https://www.hybrid-analysis.com/sample/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d
Verdict:
Malicious
File Type:
unknown
First seen:
2026-04-15T04:23:00Z UTC
Last seen:
2026-04-16T23:35:00Z UTC
Hits:
~10
Detections:
Trojan.VBS.SAgent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan-Downloader.Script.Generic
Link:
https://opentip.kaspersky.com/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d/
Verdict:
Malicious
Threat:
Family.PHANTOM_STEALER
Link:
https://tip.neiki.dev/file/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d
Threat name:
Win32.Trojan.Yomal
Create hunting rule
Status:
Malicious
First seen:
2026-04-15 17:27:46 UTC
File Type:
Binary
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7rvdpcgm7yz5vk2bxj3htf7s5bvhyjynzid7qoeem22pu2oceoq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
execution
Link:
https://tria.ge/reports/260415-wwdqgsfx8m/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Process spawned unexpected child process
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fe351bc4667f19ed55a0dd3b3ccbf974353e1386e503fc1c42335a7d34e111d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/61787/

Comments