MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed
SHA3-384 hash: a118be29b21986e4921f47c5c46171ced35b86fa86de27e81e885d74a448f049ad9df8987156dba3b8a116c4296df79b
SHA1 hash: 491269ed2d5f8086ea8f0dba785f298acef61d39
MD5 hash: 795f476eddf58bc6f15225ef96364e3c
humanhash: muppet-comet-black-sweet
File name:Request for Quotation MK FMHS RFQ 26 07 27.vbs
Download: download sample
File size:2'711'041 bytes
First seen:2026-07-27 12:08:38 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 192:2mau3NjdMuTeXhDjbLUl0LKhf76Ril3IfpDa9E1gncugi:2mauxdFeRHkCLkhl3DpcG
TLSH T1EAC593C5FEA0CA94A85E19210FF04A7CB9945792276301EDF4AEEDC5F473A18708DBE4
Magika vba
Reporter James_inthe_box
Tags:exe vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/76407/
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a674a80a26eefb0bc420b86/reports/916d44c4-2291-4185-955b-921aceed6eca/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed
Verdict:
Unknown
File Type:
text.utf8
First seen:
2026-07-27T03:33:00Z UTC
Last seen:
2026-07-27T09:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed/results?tab=lookup
Score:
67%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed
Verdict:
Malware
YARA:
1 match(es)
Tags:
DeObfuscated Obfuscated T1027 T1059.005 VBScript
Link:
https://app.malva.re/file/795f476eddf58bc6f15225ef96364e3c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2vkfarq675ql6vl5oo5ty7xyfetnxcwubgoj22rin6lmwxok3wq._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
execution
Link:
https://tria.ge/reports/260727-pbrchs11fv/
Behaviour
Executes a VBScript file via the Windows Script Host.
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/26aaa28230f7fb05faabeb9dd9e3f7c14936dc56a04ce4eb51437cb65aee56ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/76407/

Comments