MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba
SHA3-384 hash:	f0d04d42ffe06e74e6d3bdd48c8c40b55f56c349f0508754c13d887458e62590d66291f7e04f629081731e0ff88371d0
SHA1 hash:	b24f546ed728fe9d803cde8d6a90e049db5373d7
MD5 hash:	1e2cb31e92ab8ea344c52ba40cfd4068
humanhash:	oranges-oscar-twelve-music
File name:	01-Purchase_Order.pdf.lzh.rar
Download:	download sample
File size:	2'936 bytes
First seen:	2026-07-24 12:44:54 UTC
Last seen:	2026-07-24 12:47:42 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	48:AhdDQ/ww/wzx5eGObVc2I5I5yutGbK8gh8n75kT8nXmEAM5vdQ8cMVYAW25kf/+6:AhdkwwwzxkZcDGyucBgh8n7g8XmENQ82
TLSH	T150511A8A1334575AD93C5174B6DBA0127BAD501AB062589B7E5D0683118253ABD8B39C
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

51

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	01-Purchase Order.pdf.js
File size:	2'254'248 bytes
SHA256 hash:	77606f048e29dfe5bb730ad2000bbba89fb276fa99a0e7db7bf222933737dd50
MD5 hash:	684c3598235c1f6a8ad7daa1dfdefea2
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/b7cf3e64-69c3-409f-9fb5-1836b451fb62/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-07-22T07:52:00Z UTC

Last seen:

2026-07-26T01:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/1e2cb31e92ab8ea344c52ba40cfd4068

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba/

ReversingLabs TitaniumCloud Win32.Trojan.Sonbokli

Threat name:

Win32.Trojan.Sonbokli

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-22 10:39:58 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvw3ekju4vhkvsnky4pgn2uoca6q5lvbqodb5rmvn7lt4rh3qc5a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution

Link:

https://tria.ge/reports/260724-p4kensem7w/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Drops startup file

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.85

Link:

https://yomi.yoroi.company/submissions/656db22934e54eaac9aac71e66ea8e103d0eaea183861ec5956fd73e44fb80ba