MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4
SHA3-384 hash: 0e4571a1a1a32b40ea3a2e55f858423dedc8ab783f2764cf6dbfacf82e751c4eae873d3e2ca77a7115aece735d510704
SHA1 hash: 73d4b0ace1a8c63d03c5cd502215ebd7f27fc03e
MD5 hash: 0d0ef17e86a2bcfb97763c54731179a5
humanhash: speaker-harry-pizza-sodium
File name:CV - 585126.chm
Download: download sample
File size:7'577'910 bytes
First seen:2026-03-18 12:07:09 UTC
Last seen:Never
File type:
MIME type:application/vnd.ms-htmlhelp
ssdeep 196608:V95eESdQSka+5KnHSWzRQ0u0o9fA3Zna2NhvfsY:VKQfYHSWVw9oJdvkY
TLSH T154763369E97A0F35FCD443F357F12C09D20A65282BA8A84E83D13CBE8E51F34AD1961D
Magika chm
Reporter smica83
Tags:chm

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ba957a88c80c01586ba008
Tags:
ransomware extens sage
Result
Verdict:
Malicious
File Type:
CHM File - Malicious
Link:
https://app.docguard.net/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
soft-404
Link:
https://www.filescan.io/uploads/69ba95754ec2f522cc4dcd7b/reports/94456f30-ca76-45f4-9650-c478eaa8109f/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4
Verdict:
Malicious
File Type:
chm
First seen:
2026-03-18T09:50:00Z UTC
Last seen:
2026-03-18T10:13:00Z UTC
Hits:
~10
Detections:
Trojan.JS.SAgent.sb HEUR:Trojan.Script.Agent.gen Trojan-Dropper.Win32.Agent.sb Trojan.Multi.Agent.sb
Link:
https://opentip.kaspersky.com/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4/results?tab=lookup
Score:
24%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-18 12:07:21 UTC
File Type:
Binary (Archive)
Extracted files:
425
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yowcb6kobr6vqjmuhzky3tqpztoswyq3or3z5itlsu4u5janhhka._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
adware persistence spyware
Link:
https://tria.ge/reports/260318-pafjmaht5x/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Executes dropped EXE
Loads dropped DLL
Modifies WinLogon for persistence
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3ac20f94e0c7d5825943e558dce0fccdd2b621b74779ea26b95394ea40d39d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CHM_File_Executes_JS_Via_PowerShell
Create hunting rule
Author:daniyyell
Description:Detects a Microsoft Compiled HTML Help (CHM) file that executes embedded JavaScript to launch a messagebox via PowerShell

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments