MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28
SHA3-384 hash: 33258ece28c326870d2d58e5050339be05e7018b3ea7eca53614de1181b8196182188a7e95ce8e6837fef1ba283ce9f3
SHA1 hash: 28ae76790b176ae490ce7d48f84b95f6cac868e2
MD5 hash: acc70cce16779f4bc8d22c1f04248307
humanhash: helium-delaware-quiet-fifteen
File name:CommercialXInvoice.pdf.7z
Download: download sample
File size:3'052 bytes
First seen:2026-06-12 21:55:17 UTC
Last seen:2026-06-12 21:56:38 UTC
File type: 7z
MIME type:application/x-rar
ssdeep 48:pCSKxD7vPUWa7SKgKwD/pj16PISTAC15YMl+G7v7qnxSWT+ZV7KN+flajlK:pexfvPda7S3pjUjxYzGz+xp+/Kk9cs
TLSH T14D516D50AC14DFE0D5A47F3A26C8906332635F0E946C849CAA6FF26B85107682E7CD7D
TrID 61.5% (.RAR) RAR compressed archive (v5.0) (8000/1)
38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika rar
Reporter TomU
Tags:7z

Intelligence

File Origin
# of uploads :
3
# of downloads :
76
Origin country :
CH CH
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:Commercial Invoice.pdf.vbs
File size:2'022'173 bytes
SHA256 hash: 2fa4d17498d35a21df78d3cb030268b4c10421325e19dfbc2073e9f3fe5ea226
MD5 hash: 303a8f6fdd5b58911ec1284dbb2db580
MIME type:application/octet-stream
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6551a7dc-2995-4f39-b63c-3cd18074b4d5/
Detection(s):
Legacy.Trojan.Agent-1388784
Create hunting rule

Legacy.Trojan.Agent-1388773
Create hunting rule

Sanesecurity.Foxhole.Rar_pdf.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2c809d34eaf30d8ce5541a
Tags:
ransomware shell sage
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28
Verdict:
Malicious
File Type:
rar
First seen:
2026-06-11T01:39:00Z UTC
Last seen:
2026-06-13T03:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28/results?tab=lookup
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-06-11 07:53:31 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wzdrwcn6g7wnvf45j3aptmxubklv3tqmy65mydw2m5xxrtbhfiua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_tiny_vbs
Create hunting rule
Author:daniyyell
Description:Detects tiny VBS delivery technique
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research
Rule name:SUSP_RAR_with_PDF_Script_Obfuscation_RID34A4
Create hunting rule
Author:Florian Roth
Description:Detects RAR file with suspicious .pdf extension prefix to trick users
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

7z b6471b09be37ecda979d4ec0f9b2f40a975dce0cc7bacc0eda676f78cc272a28

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments