MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5bae7e992228ae84ef237014f37e50ff0d3dcbd0b3f1bbf095f09c564584bd78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

60

Origin country :

DK

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	FedEx_Shipment_Doc.js
File size:	43'379'642 bytes
SHA256 hash:	7c8676dbea0a2cfeac917864cbe73c60aa5d6d05b58ca2e97bad56bc3396a78e
MD5 hash:	9eeaa341aabb77ebca80dee08e24fe16
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9862c277-94a3-4bfe-8a0f-59710d862f00/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader dropper loader masquerade repaired

Link:

https://www.filescan.io/uploads/6aaa3303fd360319518e39cc/reports/68bbec83-ea92-4505-864b-e565d3203474/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/5bae7e992228ae84ef237014f37e50ff0d3dcbd0b3f1bbf095f09c564584bd78

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/ddb0918e8112bdf0882c47a9f3247dcd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5bae7e992228ae84ef237014f37e50ff0d3dcbd0b3f1bbf095f09c564584bd78/

ReversingLabs TitaniumCloud Script-JS.Trojan.Heuristic

Threat name:

Script-JS.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-16 03:39:42 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

8 of 36 (22.22%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=loxh5gjcfcxij3zdoakpg7sq74gt3s6qwpy3x4ev6cofmrmexv4a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution persistence privilege_escalation

Link:

https://tria.ge/reports/260916-henx8sgk4y/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Creates a file in the Startup directory

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 5bae7e992228ae84ef237014f37e50ff0d3dcbd0b3f1bbf095f09c564584bd78

(this sample)

any.run

https://app.any.run/tasks/0383e73e-f92c-499a-b7cf-018f6fd5b292

  

Delivery method

Distributed via e-mail attachment