MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea
SHA3-384 hash:	0e6dc3d2fdb3f817be048766434d3edac822152189eaea1206419e6a8050cc09572ff698d9bf435f25b9eedbe1e88ad5
SHA1 hash:	e57c90518e7fd376f8a5e537c7245d69d3a7cf0c
MD5 hash:	03f185d4ded54214958aff29adde2e8f
humanhash:	bluebird-steak-lima-king
File name:	RFQ_For_Payment_Invoice__VER12000263330-800139_pdf.txz.rar
Download:	download sample
File size:	107'241 bytes
First seen:	2026-07-03 17:52:31 UTC
Last seen:	2026-07-03 17:53:30 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:zYdmh0usTcfGzrS2fdEtV7q92iaarcciRoCB2vH3:zYdm7tOEr7q92iaIcc8b0X
TLSH	T12CA31215E29D43F04FE38298B35BA40DC7BDEAF8E86AC40DD6B1E509660FB836B4D154
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

42

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	RFQ For Payment Invoice VER12000263330-800139_pdf.js
File size:	790'710 bytes
SHA256 hash:	eb77ab5568d6decc6df35d5ed7b523972900cecc33d5c9e3ebc68e2c106ea596
MD5 hash:	bd2d2f531d51d675771b3ed5eab0924c
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/69b3e624-2a31-47e3-8a2a-e19cbadb4f8c/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.JS.Obfus-2662.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a47f77532952f8351cf6e97

Tags:

infosteal rapid

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

conhost masquerade obfuscated powershell repaired

Link:

https://www.filescan.io/uploads/6a47f72bdf45f8126e155369/reports/0ec6f461-b8b4-427f-9571-0aef07002788/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-15T22:52:00Z UTC

Last seen:

2026-07-02T20:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea/

ReversingLabs TitaniumCloud Script-JS.Trojan.AgentTesla

Threat name:

Script-JS.Trojan.AgentTesla

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-15 23:40:29 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

13 of 36 (36.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=syth43dxyrxgnewxhqzoge4a54lzlxsnysthm7hofeqntuxesdva._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/96267e6c77c46e6692d73c32e31380ef1795de4dc4a6767cee2920d9d2e490ea