MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

XWorm

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135
SHA3-384 hash:	4feed3252782a6bfc36e4b073b9e1df65fbb03ef50b6dfac47b49b0d3c578109ba4c0903e7ef911e9f4efd6083ffa358
SHA1 hash:	975bdac34193239ef7207bdc0084e568f6784bab
MD5 hash:	220f5f58f71814dad85c443564450af7
humanhash:	early-island-oklahoma-venus
File name:	invoice-1645080830.pdf (45).js
Download:	download sample
Signature	XWorm Create hunting rule
File size:	22'903'943 bytes
First seen:	2026-04-27 10:03:49 UTC
Last seen:	2026-04-27 10:04:23 UTC
File type:	js
MIME type:	text/plain
ssdeep	49152:ce5ereCele5eDeTe0eIe1eGeGUuWneMetezejeCUuWmeNePeCeceueieleie7ecz:h
TLSH	T19D3723604A768DFF06B4334F00AA1E1B26EAC57111299CE7D1F6FC9D214F37066EA68D
Magika	javascript
Reporter	JAMESWT_WT
Tags:	js xworm

Intelligence

File Origin

# of uploads :

# of downloads :

116

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Suspicious

Labled as:

PowerShell/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135

Verdict:

Malicious

File Type:

First seen:

2026-04-27T07:33:00Z UTC

Last seen:

2026-04-28T13:06:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.Script.Alien.gen HEUR:Trojan-Dropper.Win32.Agent.sb HEUR:Trojan.Script.Generic NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135

Gathering data

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tvoqbzlkwtmrj5u2oo6ox5tuvvjk7sfzplvywnjqy6jadswbwe2q._file

Result

Malware family:

n/a

Score:

8/10

Tags:

execution

Link:

https://tria.ge/reports/260427-l4y2aabt6p/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Checks computer location settings

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9d5d00e56ab4d914f69a73bcebf674ad52afc8b97aeb8b3530c79201cac1b135

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample