MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50
SHA3-384 hash:	4b18f05620976bbb069995887e6e9c82ffcafdace72cf1ed58e269604256bb054eb7716730b777b5e09932d3ce38be30
SHA1 hash:	f21f9e9dcd7cc7b14bc85e1c97ebc56cd9ed3183
MD5 hash:	a340c3bb18af62843a9d4df711a9c39a
humanhash:	rugby-low-mirror-mountain
File name:	Document_File-20260105104535.WsF
Download:	download sample
Signature	ConnectWise Alert Create hunting rule
File size:	173 bytes
First seen:	2026-01-06 07:48:53 UTC
Last seen:	Never
File type:
MIME type:	text/html
ssdeep	3:VUbvgbpV1OmIssssOjDETXI+D8UU0nGsUs+lNWEdKI1hHgCh2HAvs+0yHbn:ovgbpaNNEBKfnGss40RhHgFX+0Ub
TLSH	T158C08C671DA8507608502A00A068EC8CF48FDE3A0458E40A70972D42C81707388273A8
Magika	html
Reporter	abuse_ch
Tags:	ConnectWise wsf

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=695c11a4e148d42004dfa8e5

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 powershell

Link:

https://www.filescan.io/uploads/695cbe784f8ce373508d3d5c/reports/ae53bd25-9d8e-4b79-a9c0-b07e53cbf820/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

wsf

First seen:

2026-01-05T16:45:00Z UTC

Last seen:

2026-01-07T12:48:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Agent.sb Trojan.JS.SAgent.sb HEUR:Trojan.Script.Generic PDM:Trojan.Win32.Generic NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1845340

Signature

Joe Sandbox ML detected suspicious sample

Sample has a suspicious name (potential lure to open the executable)

Sigma detected: PowerShell Download and Execution Cradles

Suspicious execution chain found

System process connects to network (likely due to code injection or exploit)

VBScript performs obfuscated calls to suspicious functions

Wscript starts Powershell (via cmd or directly)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50/

Neiki Trojan.Win32.Agent

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50

Spamhaus Hash Blocklist

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lml7sq4ffjryp7zy2ulostm4ils7r5kkg627kwjs5xgt6aocfjia._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260106-jrfytsex7d/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5b17f943852a6387ff38d516e94d9c42e5f8f54a37b5f55932edcd3f01c22a50