MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a
SHA3-384 hash:	3c9f6bc8a00bea7286d4e9aad4b562c8799ed14e1f4db9b37fda217a8aa4bffb3de948c9761060adc507963f092e6c37
SHA1 hash:	397442d41bb52da2502482bf5bd037ae3c6aaf41
MD5 hash:	f26679054e31880e50beb99b4c015a6b
humanhash:	mockingbird-wisconsin-uniform-kilo
File name:	PurchaseXOrderXQuote_Confirmation_November04-2025_pdf.txz
Download:	download sample
File size:	269'765 bytes
First seen:	2026-07-03 18:00:40 UTC
Last seen:	2026-07-03 18:01:04 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:cvvYNQIJmCnvsz/eNhsbeAcSOFS6TFGZBZJGrVbriE5OoynNhLz:cvqQIXn0yN2mSAszurVrEoyn3z
TLSH	T16244234BBE09C7FC8AD7C0107755ACE7024FC2855286989BF39E1481A6FE74A967CB70
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

43

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	Purchase Order Quote_Confirmation_November04-2025_pdf.js
File size:	1'825'376 bytes
SHA256 hash:	fc9dfaa930c8e1f5947bf04f2febb12e29785bf79e3f167a8785dc0ccbd352fa
MD5 hash:	3fe6805ed540e921119bcb3da43263da
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e85ff662-f73a-4f2d-b360-5f7b7a8e5f36/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a47f98b762b0b26f3cf7a96

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost encrypted masquerade obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a47f8e4df45f8126e15579e/reports/6bc08044-b866-4daa-b7f5-100fe9574a07/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-25T06:05:00Z UTC

Last seen:

2026-07-02T10:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/f26679054e31880e50beb99b4c015a6b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a/

Neiki Exploit.Win32

Verdict:

Malicious

Threat:

Exploit.Win32

Link:

https://tip.neiki.dev/file/3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-25 10:15:34 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h6sj22ajlfwmec7mxn7htbawggdsggrvlicv23qpwu73p7tturva._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3fa49d6809596cc20becbb7e7984163187231a355a055d6e0fb53fb7fe73a46a