MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

DK

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	FedEx Shipping Documents.js
File size:	4'879'040 bytes
SHA256 hash:	58cc29e0da304944912809983407283ab15417fb1e14d1733179bbe3b8a70b89
MD5 hash:	6b9cd4dd040e731fa3a4a36478d2fad8
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9f898f6a-e094-4d95-8da4-b30609596103/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Rogue.0hr.20261002-0536.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader dropper loader masquerade repaired

Link:

https://www.filescan.io/uploads/6abf5b69f74b67606958ecdc/reports/47c5eebf-786d-4eaa-a563-0be2d3665e7f/overview

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-10-02T00:26:00Z UTC

Last seen:

2026-10-04T05:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/2eeb9c5c102f83ce1a1c33d0ce010b7b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-02 04:56:37 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p2rq6ucragsrpdsr6ym3z4h6e7m6xxgc6jvw67knhnul2zqqpuqq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/261002-jshttax15m/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Reads the TCP/IP host and domain name from the registry

System Network Configuration Discovery: Internet Connection Discovery

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Creates a file in the Startup directory

Badlisted process makes network request

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

rar 7ea30f505101a5178e51f619bcf0fe27d9ebdcc2f26b6f7d4d3b68bd66107d21

(this sample)

any.run

https://app.any.run/tasks/ea3f6708-8ac0-4628-872a-59fef2ff2e78

  

Delivery method

Distributed via e-mail attachment