MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2
SHA3-384 hash:	443cec0112f36458820a1e51031dab81fc17adf3288371b08e39fd3f82b49881d684ce43da29f41116ee23d11d854e75
SHA1 hash:	115064cd7876db1321d30d8380f12e7112cf6ec6
MD5 hash:	1bc3cb9272bea8af789e1b0554abbcad
humanhash:	michigan-single-twenty-diet
File name:	Payment_Receipt_Swift_50%_Against_Order_Confirmation.pdf.txz
Download:	download sample
File size:	114'940 bytes
First seen:	2026-06-06 18:44:51 UTC
Last seen:	2026-06-08 15:01:03 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:DSO0pDXfYU8bG6J0+ghI3QefE+UiUVwCS2oVrBP:Q776JkhIf7U9VwCo
TLSH	T1A7B3120D841EC80AB4EBB872CDB431D75010FEDF1C7700857695E5A4E2A76A8D6EAB63
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	TomU
Tags:	rar

Intelligence

---

File Origin

# of uploads :

6

# of downloads :

52

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	Payment_Receipt_Swift_50%_Against_Order_Confirmation.js
File size:	823'312 bytes
SHA256 hash:	d4e2fc9946830fa27ea397c7dab7ffc56501f7b75df4deede18bc2708fa23f1b
MD5 hash:	47311097d3c5866b80f61d1b6e99b711
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ad80b099-5a2e-446a-93be-f1eacbda6cc4/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Suspicious-Rar-JS.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a22a486f8676ad4d3615de3

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 conhost masquerade powershell repaired

Link:

https://www.filescan.io/uploads/6a246ad046e44aecc0d29d56/reports/74e1aa0e-2f89-43f5-9a0d-4f9f9c848762/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-06-06T14:16:00Z UTC

Last seen:

2026-06-07T21:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2/results?tab=lookup

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2/

Neiki Trojan.Script

Verdict:

Malicious

Threat:

Trojan.Script

Link:

https://tip.neiki.dev/file/c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-05 11:48:13 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yt2ucv34cn43qocthpy6uy3grcwgx4xwqj5cd6oiiltcfi5utdza._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c4f541577c1379b838533bf1ea636688ac6bf2f6827a21f9c842e622a3b498f2