MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 982293f2b322088bf0ab50c4fed8797cfc6e2d410d438c908e3d5b8a48295d8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	982293f2b322088bf0ab50c4fed8797cfc6e2d410d438c908e3d5b8a48295d8e
SHA3-384 hash:	cc737ff5065a26841f821bcc751fbf95b7c587efb673a05933c05c93e0a3e5975bc29c3cba923114897fd83120a68442
SHA1 hash:	016d7e38bdac7171bce679f6570b659955240ec3
MD5 hash:	9b0caeab035bd9328b90cc77ca4ef5db
humanhash:	sixteen-vermont-paris-spaghetti
File name:	Fedex268534836_pdf.vbs
Download:	download sample
File size:	42'973'314 bytes
First seen:	2026-09-15 12:57:58 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	1536:e2845wr5mrshKiimGFN/phFNBMpMUELhANSgzHjrku1Mti+8bLokFUIg5QamDN9b:s
TLSH	T19E975E1D20DC28D252E96CC421D107F6FD9068DB0B2A59C7F5680FFBB5F31AE609369A
TrID	66.6% (.TXT) Text - UTF-16 (LE) encoded (2000/1) 33.3% (.MP3) MP3 audio (1000/1)
Magika	vba
Reporter	abuse_ch
Tags:	FedEx vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

SE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6aa94104b6f43ee830cda251/reports/cadf1bd7-c80a-4b86-96d5-0efbc2d5a151/overview

Hybrid Analysis AsyncRAT

Verdict:

Malicious

Labled as:

AsyncRAT

Link:

https://www.hybrid-analysis.com/sample/982293f2b322088bf0ab50c4fed8797cfc6e2d410d438c908e3d5b8a48295d8e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-09-14T23:06:00Z UTC

Last seen:

2026-09-16T07:35:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/982293f2b322088bf0ab50c4fed8797cfc6e2d410d438c908e3d5b8a48295d8e/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spre.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1973138

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Bypasses PowerShell execution policy

Creates processes via WMI

Detected large data written to user environment variables, potentially indicating payload staging for fileless execution

Drops VBS files to the startup folder

Found suspicious powershell code related to unpacking or dynamic code loading

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Copy file to startup via Powershell

Sigma detected: Drops script at startup location

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious Environment Variable Has Been Registered

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected MSIL Crypter

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-WScript.Backdoor.AsyncRAT

Threat name:

Script-WScript.Backdoor.AsyncRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-15 02:22:30 UTC

File Type:

Binary

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tarjh4vteieix4flkdcp5wdzpt6g4lkbbvbyzeeohvnyusbjlwha._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

execution persistence privilege_escalation

Link:

https://tria.ge/reports/260915-p7wbcaxeqg/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Creates a file in the Startup directory

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/982293f2b322088bf0ab50c4fed8797cfc6e2d410d438c908e3d5b8a48295d8e