MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461
SHA3-384 hash:	1eb016b2621f72d99ad101435a3c94b0bf9879d337c4c2f9c13a946bd01d488618a130b6609fdbf0ac4f871ff8ee275f
SHA1 hash:	f4e3e465b7b6a1c87ce744d5284a46869d5da11f
MD5 hash:	0ef7debc05372185d6a6c837aff61a92
humanhash:	mississippi-alanine-mango-six
File name:	mlq8jlxw6o.vbs
Download:	download sample
File size:	3'771'299 bytes
First seen:	2025-09-09 12:56:24 UTC
Last seen:	Never
File type:	pdf
MIME type:	application/pdf
ssdeep	98304:PHuoU+VqgXxKRJB460DWlXDm1U6JMyoHnKu:A
TLSH	T1BE06C577EA1113ED5F83968F4A07EFD6EA69B20062131858718E36479B438EC4373D6E
Magika	pdf
Reporter	JAMESWT_WT
Tags:	croci-group-com pdf vbs

Intelligence

File Origin

# of uploads :

# of downloads :

516

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Other.Malware-gen.92438722.UNOFFICIAL

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68c024516e66ba602d79667a

Tags:

n/a

Verdict:

Suspicious

Labled as:

Trojan.Script.VBS

Link:

https://www.hybrid-analysis.com/sample/a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461

Label:

Benign

Suspicious Score:

2.7/10

Score Malicious:

28%

Score Benign:

72%

Link:

https://www.malware.ai/gui/files/?id=961dca2f-43f3-483d-9e91-77b10dc16345

Verdict:

Clean

File Type:

pdf

First seen:

2025-09-09T12:22:00Z UTC

Last seen:

2025-09-09T12:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461/results?tab=lookup

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

Html

Link:

https://app.malva.re/file/0ef7debc05372185d6a6c837aff61a92

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uvgsisgbb5r2jfe6b5noiqym6yhc6e5viprm6265auvjt6h6yrqq._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/a54d2448c10f63a4949e0f5ae4430cf60e2f13b543e2cf6bdd052a99f8fec461

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries