MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e
SHA3-384 hash:	7f72c39899994a1fdde1642c51aa45fc4a6d7c3ec284f09171323cd23afe373ee14c8f9a75b0b7f3769afe993a25a30e
SHA1 hash:	804b1711a92dae6d7b206450175fabf7be76392c
MD5 hash:	a430f2132ed78ff72663823171332bed
humanhash:	uranus-table-floor-grey
File name:	test.bef_fri
Download:	download sample
File size:	24'531 bytes
First seen:	2026-08-14 06:23:21 UTC
Last seen:	Never
File type:	rtf
MIME type:	text/rtf
ssdeep	384:9TbW6ZrDgpQdk1fxBxlmjvdaN7UCOqcKqjRcPiycvFGLziMCioaWNmPTLoQu6:93BrcSd5U2COqcfjRXJkCsosPC6
TLSH	T18CB2F1DE80185CC147D374BD6BD4AF0907D6E24C2ECDB8A093AE9A4EE0D4687C77255B
TrID	83.3% (.RTF) Rich Text Format (5000/1) 16.6% (.JSON) JSON object (generic) (1000/1)
Magika	gzip
Reporter	abuse_ch
Tags:	rtf

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

62

Origin country :

DE

Vendor Threat Intelligence

ACCE RTF_FileType

Malware configuration found for:

MSO

Details

Link:

https://research.acce.ciphertechsolutions.com/results/21cd2f9b-0e8c-4b8d-8c0f-bde05c820525/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

http://217.60.36.94/chess/test.bef_fri

Verdict:

No threats detected

Analysis date:

2026-07-30 19:27:59 UTC

Tags:

opendir

Link:

https://app.any.run/tasks/ce1f676b-d386-49f5-825f-39eafd0ac336

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Legit

Verdict:

Legit

File type:

application/rtf

Has a screenshot:

False

Contains macros:

False

ClamAV Detected

Detection(s):

TwinWave.EvilRTF.LeanTextFormat.20240611.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

RTF File

Link:

https://app.docguard.net/bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e/results/dashboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a7eb4619cef1a7ee4546c68/reports/3b38302c-d8f3-4d39-87e6-b199838620bd/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

evad

Score:

23 / 100

Link:

https://www.joesandbox.com/analysis/1958051

Signature

Office drops RTF file

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqeiuqemhhh6yxvo2xc2axis26sfzzm3rl3iemko3viuschajj7a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/260814-g5qn3sej4s/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bc088a408c39cfec5eaed5c5a05d12d7a45ce59b8af682314edd514908e04a7e