MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032
SHA3-384 hash: e90c9949161ae33f332b087c9d9d325c62c8c940c5234cf46859caf02598b0be7b6e4d4dfd27fb5d67a7e50ba0da5597
SHA1 hash: 971320c8fc9e663339988d3e95879653bbf3c1b2
MD5 hash: 9abb71ae94aec7126993a44c9f40861b
humanhash: robin-delta-march-beryllium
File name:filedata.chm
Download: download sample
File size:1'992'434 bytes
First seen:2026-03-31 14:25:17 UTC
Last seen:Never
File type:
MIME type:application/vnd.ms-htmlhelp
ssdeep 49152:krqCL+seQ0naiq/kqB85LyhV0N8042Ty2gtuvVq5k2nee:krq2eQ0a5/8QdyS8Akk
TLSH T1939533DD60983C19C749AD32D5F0F636E35D9A2068E5A3E4D6427699EAD20CC2F338A1
Magika chm
Reporter smica83
Tags:chm Plugx

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
HU HU
Vendor Threat Intelligence
Gathering data
Detection(s):
Win.Loader.PlugX-10043836-0
Create hunting rule

Sanesecurity.Malware.27118.LnkHeur.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69cbd9546363ca5d27f034a5
Tags:
n/a
Result
Verdict:
Malicious
File Type:
CHM File
Link:
https://app.docguard.net/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032/results/dashboard
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032
Verdict:
Clean
File Type:
chm
Link:
https://opentip.kaspersky.com/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032/results?tab=lookup
Score:
5%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v6f7dbela3b2ii3lco2x7chjyj2exq6d3mvnzeo4x4zaqyw4yaza._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/260331-rrf8labs3q/
Behaviour
Suspicious use of SetWindowsHookEx
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af8bf1848b06c3a4236b13b57f88e9c2744bc3c3db2adc91dcbf320862dcc032

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://x.com/i/status/2038963404463833163

Comments