MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83
SHA3-384 hash: d3b465c65a47bf579d03c476410ffba12d0771d82d94c4a291adc3826b13fe85763ac37561a9545de420168ad5810e31
SHA1 hash: ec6deea196a0d187b70d1dde0b5455926c03c129
MD5 hash: 8706f246b4594326e9d4ef0b9208fb7a
humanhash: beryllium-burger-grey-quiet
File name:BL.pdf.7z
Download: download sample
File size:3'036 bytes
First seen:2026-06-12 21:55:12 UTC
Last seen:2026-06-12 21:56:36 UTC
File type: 7z
MIME type:application/x-rar
ssdeep 48:5yKxD7vPUWa7SKgKwD/pj16PISTAC15YMl+G7v7qnxSWT+ZV7KN+flajlK:5PxfvPda7S3pjUjxYzGz+xp+/Kk9cs
TLSH T1BF515C50AC149FE0D5546F3626C8906332634F0E946C84ACAA6FF26B85107682E68D7D
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:7z

Intelligence

File Origin
# of uploads :
3
# of downloads :
79
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:BL.pdf.vbs
File size:2'022'173 bytes
SHA256 hash: 2fa4d17498d35a21df78d3cb030268b4c10421325e19dfbc2073e9f3fe5ea226
MD5 hash: 303a8f6fdd5b58911ec1284dbb2db580
MIME type:application/octet-stream
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b7cb494f-5ed9-4567-ae2e-de6df678bcca/
Detection(s):
Legacy.Trojan.Agent-1388784
Create hunting rule

Legacy.Trojan.Agent-1388773
Create hunting rule

Sanesecurity.Foxhole.Rar_pdf.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2c809d34eaf30d8ce5541a
Tags:
ransomware shell sage
Verdict:
Suspicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83
Verdict:
Malicious
File Type:
rar
First seen:
2026-06-11T01:39:00Z UTC
Last seen:
2026-06-14T01:00:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-06-11 07:54:02 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsc5nm7ei74iegcfjfhprfu5wv273eoysk2zijpxlvkl56htp6bq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

7z 2c85d6b3e447f8821845494ef8969db575fd91d892b59425f75d54bef8f37f83

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments