MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6
SHA3-384 hash:	e4abf655b3b89dbdac363e42bea806f1e1495dccb849167ee68fccec2953349deb76124ab7980a9e3bcffe80ab7c2cc7
SHA1 hash:	2934a773271b508f9a258353df2e2f85ea4ced0f
MD5 hash:	549d78eeb5cdbf236c9e28869f1e2ce0
humanhash:	finch-fifteen-zebra-september
File name:	PURCHASE INQUIRY DAEP-DWCESTUAELT-9771 EXPANSION PROJECT.vbs
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	35'514 bytes
First seen:	2026-10-12 12:16:21 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	768:N6eP9JCSKvPo6odA7gGcTfqMZxoG5ff1R3uaK045Ee:UePqSKY6eFzFbpXuaKWe
TLSH	T1E9F24AB1CE661018090BABB7EC842972D9B46859214B04B4BFBC731D581B66C77FF98F
Magika	vba
Reporter	James_inthe_box
Tags:	exe GuLoader vbs

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

227

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91538/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.64274477.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad0fa2a6f551121ba161923

Tags:

virus shell sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

cmd encrypted lolbin masquerade

Link:

https://www.filescan.io/uploads/6acccfcc166c8516772bfb3d/reports/43c21bab-90a4-49df-a0c7-f5e47dc5a8c4/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

vbs

First seen:

2026-10-11T20:25:00Z UTC

Last seen:

2026-10-14T08:05:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6

Malva.RE Malware

Verdict:

Malware

YARA:

1 match(es)

Tags:

DeObfuscated Obfuscated SOS: 0.31 T1027 T1059.005 VBScript

Link:

https://app.malva.re/file/549d78eeb5cdbf236c9e28869f1e2ce0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6/

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-12 00:58:33 UTC

File Type:

Text (VBS)

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z67vyprut7trxuo7vpry5wuo35f2dozeocb5jlf3hnuod77ydhla._file

Hatching Triage guloader

Result

Malware family:

guloader

Alert

Create hunting rule

Score:

  10/10

Tags:

family:guloader defense_evasion discovery downloader execution privilege_escalation

Link:

https://tria.ge/reports/261012-pf52gazz4j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Suspicious use of NtSetInformationThreadHideFromDebugger

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Family: Guloader,Cloudeye

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cfbf5c3e349fe71bd1dfabe38eda8edf4ba1bb247083d4acbb3b68e1fff819d6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/91538/