MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0
SHA3-384 hash:	69387c7665f878d453629a2163a32d80c670115f064721e7b3032ef382f3bfea8eb39aed4f5e8338da745fdf4267bb3f
SHA1 hash:	04aad46746fecfcccd94a497edb1fd15d1ce1349
MD5 hash:	409dc8f78ec710c4b0b440e22fd471fe
humanhash:	emma-early-grey-cardinal
File name:	wp-core-sync.php
Download:	download sample
File size:	3'842 bytes
First seen:	2026-10-01 19:06:12 UTC
Last seen:	Never
File type:	php
MIME type:	text/x-php
ssdeep	96:GTSX42ry6qCHx+w7P5Os6wIq5kEF7FXyRJbplVuFL:x/XR+COcIm/7F2luFL
TLSH	T11F812B1E530461C347A6E024844DA55DB2AE22E6E161C5CEF2EB7CAC9BB3AE805B3495
Magika	php
Reporter	emilstahl
Tags:	ClickFix hidden-plugin injector php wordpress

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

91

Origin country :

DK

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Generic.PHP.Injector.1.C168CC05.34491664.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6aced2d42e5d8a93d8153c7a

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

base64 obfuscated

Link:

https://www.filescan.io/uploads/6abeaf37d019672d48a6082c/reports/d403849f-554f-4df1-bc59-b051eef56fac/overview

Hybrid Analysis PHP.Injector.1.Generic

Verdict:

Malicious

Labled as:

PHP.Injector.1.Generic

Link:

https://www.hybrid-analysis.com/sample/967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

js

Link:

https://opentip.kaspersky.com/967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0/results?tab=lookup

Nucleon Malprob Susipicious

Score:

50%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0/

ReversingLabs TitaniumCloud Script-PHP.Trojan.Heuristic

Threat name:

Script-PHP.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 05:17:41 UTC

File Type:

Text (PHP)

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=szzwtmoksrsdtpb3y6zac7rcthtyg7h266rjs6pzwvelgxfpqtqa._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/967369b1ca946439bc3bc7b2017e2299e7837cfaf7a29979f9b548b35caf84e0