MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87
SHA3-384 hash:	f4f4b674fc840bc4c8733d0bce5dbc6cc78e4ec486458089f183fc93eb03f88592d531e460a357d68f4aae99bab50e63
SHA1 hash:	e0734e1fc6d6f0b6adb55103ed15d9d1430c3fed
MD5 hash:	7497bdd65497f4ab16ec0241ab069717
humanhash:	angel-earth-october-london
File name:	SH_6456353975_74647543DOC_654674_PDF.rar
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	940'838 bytes
First seen:	2026-10-14 15:07:51 UTC
Last seen:	2026-10-14 15:09:07 UTC
File type:	rar
MIME type:	application/vnd.rar
ssdeep	24576:YZtBZasjjYT8qQQ5ueaG13w9SKKSS38if:yBwsXYwxBEzl38if
TLSH	T199153396717FD490D7370F7227B03E4CDDBE147F9A67B520B120A39ED844AA0F8A6192
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar xworm

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

52

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	SH 6456353975 74647543DOC 654674 PDF.JS
File size:	3'094'429 bytes
SHA256 hash:	baa7ed37ec33405614a09621cfdf4fdb9d50c7ca752d18d6b1ae184cd5319b72
MD5 hash:	e0b9b96f13bd5af5ffc90d394fedbc1b
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/52ff6499-6085-4e7f-984e-f3dc6f68f43b/

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.DownLoader.10820.2675.24387.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac68a9ec221a7c08107400c

Tags:

blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug dropper evasive obfuscated packed repaired

Link:

https://www.filescan.io/uploads/6acf9af785079cf7852f25d1/reports/f56397c4-b3b0-4bb6-bc0c-9acd62932ea8/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-08-24T07:43:00Z UTC

Last seen:

2026-09-13T10:28:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/7497bdd65497f4ab16ec0241ab069717

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87/

ReversingLabs TitaniumCloud Script-JS.Trojan.Modildr

Threat name:

Script-JS.Trojan.Modildr

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-25 08:02:55 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l5dnt2b2opuizrzo63qk73juxylgjbnswtd6o4dnlfxakpjfxsdq._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm defense_evasion discovery execution rat trojan

Link:

https://tria.ge/reports/261014-s3xv6ae15t/

Behaviour

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks computer location settings

Executes dropped EXE

Detect Xworm Payload

Family: Xworm

Malware Config

C2 Extraction:

80.96.109.204:2021

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/5f46d9e83a73e88cc72ef6e0afed34be166485b2b4c7e7706d596e053d25bc87