MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd
SHA3-384 hash:	5cf9e2efb7d077f63bae207cc0e4d3ee875ce47fedddc6b784cb7769030c6e15477c759e05a70f07becfb7431163d705
SHA1 hash:	0b6512e044da89ddededeb7793da1595f7b3f2d3
MD5 hash:	c56ecb47e6cecfabf80b6649ff666e6e
humanhash:	sierra-artist-stairway-minnesota
File name:	Documento_6789789_pdf.cab
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	10'923 bytes
First seen:	2026-02-24 07:04:57 UTC
Last seen:	Never
File type:	cab
MIME type:	application/vnd.ms-cab-compressed
ssdeep	192:C6Y1coTUTc9I8anGunprFz9x+7iYs1bx5cF7QDNABnX/U0jhOxFUK3Rz+bH:RY1OcbIrRxUCQRWABnX/UhXx3J+7
TLSH	T15432BFC04252B852E8A9D935E301E6257CB1AD1E02E3DD3CFFD05759CCCF619818B6AC
Magika	cab
Reporter	JAMESWT_WT
Tags:	cab xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

24

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Documento_6789789_pdf.js
File size:	31'005 bytes
SHA256 hash:	98552e9d476eea24e2c8cb403ff415ed634c4b5e4d8c03e60e76d7a2475461ba
MD5 hash:	0b517b1643e2737931f2506b352af3dd
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Cabinet_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/22bf969d-3607-4ccf-89d0-9f18fc442d0f/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.12665714.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.79133571.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.FileRepMalware.91952748.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699d4dc88fffa866e3b17dd0

Tags:

ransomware shell virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aspnet_compiler base64 evasive evasive lolbin masquerade obfuscated obfuscated reconnaissance repaired

Link:

https://www.filescan.io/uploads/699d4dbb97feb4afd65602a7/reports/2aabe78a-b73f-4190-97d8-b7813c0b1241/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

cab

Link:

https://opentip.kaspersky.com/c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd/

Neiki Family.XWORM

Verdict:

Malicious

Threat:

Family.XWORM

Link:

https://tip.neiki.dev/file/c7d9514a98eb79cad8e039c576f53a77afe2a80535466020bc60bb0efff414fd

ReversingLabs TitaniumCloud Win32.Trojan.Etset

Threat name:

Win32.Trojan.Etset

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-20 16:41:20 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y7mvcsuy5n44vwhahhcxn5j2o6x6fkafgvdgaif4mc5q577uct6q._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260224-hz14ases3h/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.