MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975
SHA3-384 hash:	ca2690c619e427aecba93fd857a135807f6e400b8538677ee3ba1969a58a2e174d2a9ab2264d59a095130491ca016be1
SHA1 hash:	70329b4d3a3d8353011408432d6a6c1993a16c3f
MD5 hash:	71d2ff4525f545124ad088b266f6ebf6
humanhash:	nebraska-johnny-november-lion
File name:	Doc6754321-36265.pdf.vbs
Download:	download sample
File size:	2'628 bytes
First seen:	2026-07-29 13:26:44 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:EwC/DXYy5qbWsj3Rov2AjhUsacAsh0XuWqBR6ATdARwP:EwC/DXYy52BlUIuf
TLSH	T1C45187BFAF1CC33009923A6742D58C1DA02B4FABACD19880A15FC41E375577646E6C5F
Magika	vba
Reporter	abuse_ch
Tags:	vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

77

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/76705/

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm cscript evasive evasive lolbin masquerade persistence

Link:

https://www.filescan.io/uploads/6a69ffc49e5ec49137923bd5/reports/145bb42e-3176-436b-901d-4c4a8e4dc124/overview

Hybrid Analysis Trojan_Script_Wacatac_B_ml

Verdict:

Malicious

Labled as:

Trojan_Script_Wacatac_B_ml

Link:

https://www.hybrid-analysis.com/sample/89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-07-28T14:25:00Z UTC

Last seen:

2026-07-30T19:37:00Z UTC

Hits:

~1000

Detections:

Trojan.Win32.Agent.sb Trojan.JS.SAgent.sb Trojan-Spy.Win32.Sapphire.sb Trojan-Spy.Win32.Agent.a BSS:Trojan.Win32.Generic HEUR:Trojan.VBS.SAgent.gen Trojan.Win32.Pdfer.sba NetTool.cURLGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1949542

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Creates multiple autostart registry keys

Deletes itself after installation

Multi AV Scanner detection for submitted file

Sigma detected: Curl Download And Execute Combination

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suricata IDS alerts for network traffic

Suspicious execution chain found

Unusual module load detection (module proxying)

Uses an obfuscated file name to hide its real file extension (double extension)

VBScript performs obfuscated calls to suspicious functions

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

49%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

Scripting.FileSystemObject T1059.005 VBScript WScript.Shell

Link:

https://app.malva.re/file/71d2ff4525f545124ad088b266f6ebf6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975/

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-29 13:27:45 UTC

File Type:

Text (VBS)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rgwvrjq4nj3uyc3g4x52jihh7obqddwtyj6x3avzcdaz6vnudf2q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

discovery execution

Link:

https://tria.ge/reports/260729-qqccksxsfz/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

cURL User-Agent

Browser Information Discovery

Enumerates physical storage devices

Executes a command shell one-liner

System Time Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Deletes itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

URLhaus

https://urlhaus.abuse.ch/url/3893427/

Cape

https://www.capesandbox.com/analysis/76705/