MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2
SHA3-384 hash:	54383a862e513560ef181a52561588b3fe0ec5c272918869b08b33ee29c0e5257c4598c7907e10bc0182302b564bea13
SHA1 hash:	477dfc14a560c0ed1c0f984955b4d5f77e3c93ef
MD5 hash:	4785d191a6eac7540d66ca9d1d764d23
humanhash:	edward-summer-double-delaware
File name:	testx.pdf.vbs
Download:	download sample
File size:	2'265 bytes
First seen:	2026-04-13 17:00:34 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:w2KkMAqHP43J0dS5uTgD/A3Nnsk6Afo8/uS:MkUP4ZkS56kUf6qo8mS
TLSH	T1BF41B5EFE4169334CE434274016A6D9DDF12E63B15029050FA8C4D45BB109B1F3A13DB
Magika	vba
Reporter	Mr128BitOff
Tags:	refundonex-com stealer-campaign vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/61417/

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69dd2167f68adfe1003976c5

Tags:

virus remo

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade obfuscated powershell soft-404

Link:

https://www.filescan.io/uploads/69dd215a799d5bf325fbe29e/reports/a68ef003-12be-4f15-b99d-e782b7ed18e1/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/VBS.Agent.f

Link:

https://www.hybrid-analysis.com/sample/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2

Verdict:

Malicious

File Type:

vbs

First seen:

2026-04-13T12:25:00Z UTC

Last seen:

2026-04-14T03:44:00Z UTC

Hits:

~100

Detections:

Trojan.JS.SAgent.sb Trojan-Downloader.Agent.HTTP.C&C HEUR:Trojan-Downloader.Script.Generic

Link:

https://opentip.kaspersky.com/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2/results?tab=lookup

Score:

14%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2/

Verdict:

Malicious

Threat:

Trojan-Downloader.Agent.SAgent

Link:

https://tip.neiki.dev/file/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-04-13 15:40:28 UTC

File Type:

Text (VBS)

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=luae54ooefhhtthnfzu6dq7mpzk5lddlejwtyilgffygz7apeoza._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery

Link:

https://tria.ge/reports/260413-vjradags71/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

Enumerates physical storage devices

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Checks computer location settings

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/5d004ef1ce214e79cced2e69e1c3ec7e55d58c6b226d3c216629706cfc0f23b2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)