🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7
SHA3-384 hash: 0c95d3d5d3fd872e03c47c3660567e2f8a75315f8af7d9bb788e73326984c4ddd5512b84e1deb0b04741fa6eeb8ed65b
SHA1 hash: bf90aff64ff48ea575b9dacb0327c0da7582d64f
MD5 hash: f6d9733675e87b0aafbb0a9d8f66283b
humanhash: sad-michigan-charlie-stream
File name:Adobe_Reader.zip
Download: download sample
File size:13'054 bytes
First seen:2026-09-11 12:29:56 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:mfu7UFYjCTWcKhRjEcaTalg0/ixh7UPIj+gFq48o:msKTM3UGlJixGQCgFn
TLSH T1F842B07AD86EECAB444C68DA6C46EA333341353B0FBE49605F6A542E107BC91399C1D7
Magika zip
Reporter cocaman
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Adobe.Reader.js
File size:46'282 bytes
SHA256 hash: 1d25cf1b14e918c0d6922d30f3b5766424c64a2965c220ab89d909e10aace891
MD5 hash: 9028ab5e30758a26c9639dc0566b0ddf
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ac9e41f9-46e9-4167-b901-f8a863cfcfae/
Detection(s):
Sanesecurity.Malware.32568.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
JS File - Malicious
Link:
https://app.docguard.net/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cscript evasive expand lolbin lolbin obfuscated powershell repaired rundll32
Link:
https://www.filescan.io/uploads/6aa3f45cb4972f8b18544d92/reports/06b0f8f8-66d5-45e4-b00b-e85458a11e0e/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7
Verdict:
Malicious
File Type:
zip
First seen:
2026-09-11T11:59:00Z UTC
Last seen:
2026-09-11T12:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7/results?tab=lookup
Score:
97%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7
Verdict:
inconclusive
YARA:
2 match(es)
Tags:
Zip Archive
Link:
https://app.malva.re/file/f6d9733675e87b0aafbb0a9d8f66283b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-11 12:30:45 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vnpxijmgrgkycnjmp273lw37idjlko5yc6ac46hasof47xlsxl3q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
backdoor defense_evasion discovery execution persistence privilege_escalation rat revoked_codesign
Link:
https://tria.ge/reports/260911-rlsdnsxsfw/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Hide Artifacts: Ignore Process Interrupts
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Enumerates connected drives
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Sets service image path in registry
Signed with revoked ConnectWise certificate
Malware Config
Dropper Extraction:
https://pub-814de71aba7d4258ae0ca369fdb8002f.r2.dev/WindowsExplorerSupport.msi
https://github.com/chockscity/x9q3m2k7b/releases/download/v1/a.msi
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ab5f742586899581352c7ebfb5db7f40d2b53bb817802e78e0938bcfdd72baf7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments