MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 5512ac2f5feeaed2caf37621123873c0f7813ee6cf40f4c530c8bce8097a01fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 9
| SHA256 hash: | 5512ac2f5feeaed2caf37621123873c0f7813ee6cf40f4c530c8bce8097a01fb |
|---|---|
| SHA3-384 hash: | 02dda98ecbd4165550b511e471f3c20cbb021d5c60d740625d1b5abaf31e1024bb51f425d219a3eb41b9459110cfc845 |
| SHA1 hash: | d0907e561accb41b24aa0547f5830be3af41eeb8 |
| MD5 hash: | e96bda527de9913f199ab02e41f9857a |
| humanhash: | arkansas-winter-bacon-charlie |
| File name: | rimportante_041b48bf.vbs |
| Download: | download sample |
| File size: | 106'194 bytes |
| First seen: | 2026-05-28 05:00:29 UTC |
| Last seen: | Never |
| File type: |  vbs |
| MIME type: | text/plain |
| ssdeep | 768:o5vgbfRQCLl9wSC7QAoGAt5bdMBjtPrmuWDrQKKoBW69QeXiQF0m0XskVIUzDRH8:2FBrnoHC8 |
| TLSH | T102A31541F7F94119BAB72F442EB906B8497BBFA2153DC9DDCA500D4E0B32518A93873B |
| TrID | 66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1) |
| Magika | vba |
| Reporter |  FXOLabs |
| Tags: | vbs |
Intelligence
File Origin
# of uploads :
1
# of downloads :
83
Origin country :
USVendor Threat Intelligence
No detections
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
92.5%
Tags:
obfuscate extens xtreme
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
evasive obfuscated opendir powershell
Verdict:
Malicious
File Type:
vbs
First seen:
2026-05-28T01:10:00Z UTC
Last seen:
2026-05-30T03:22:00Z UTC
Hits:
~1000
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic HEUR:Trojan.VBS.SAgent.gen
Score:
45%
Verdict:
Susipicious
File Type:
SCRIPT
Gathering data
Verdict:
Malicious
Threat:
Trojan.JS.SAgent
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2026-05-28 05:01:56 UTC
File Type:
Text
AV detection:
9 of 38 (23.68%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
execution
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Badlisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
vbs 5512ac2f5feeaed2caf37621123873c0f7813ee6cf40f4c530c8bce8097a01fb
(this sample)
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.