MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be
SHA3-384 hash:	e244511028caacbb7dd750f868bc592a04969a100e67e58a9ce55c970e6b6c61b9a8fda4b36544e0803422fd6f7831a0
SHA1 hash:	18734b01dd0491008bf12ee2f4536f79b78a53e0
MD5 hash:	f2e349743d0cc29e7294298657c860c2
humanhash:	beryllium-delta-jersey-early
File name:	documento_pdf.7z
Download:	download sample
Signature	XWorm Alert Create hunting rule
File size:	9'569 bytes
First seen:	2026-02-24 07:05:01 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	192:4b4Q6BOmCfc4YZczMh1tBi0Q625K2KmWObc68+1gFAPqbZm9mZ8n/j:Er6wmCpZgPBT25K2YObcfYGADIZWr
TLSH	T16812AEF5B028EAC3F93BA994BD122707FF50EDAB494076F26929A64F2E00480461F479
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	JAMESWT_WT
Tags:	7z xworm

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

IT

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	documento_pdf.js
File size:	26'933 bytes
SHA256 hash:	ad003daf9429a855d165cde5b5e558ccebc55b8b39d28dc3f7c93940652bf74e
MD5 hash:	f07dc86affb08817ffbbb005f3be6ebe
MIME type:	text/plain
Signature	XWorm

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.99368632.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.64471817.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.FileRepMalware.16213851.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=699d4dbac950ab5d9ab121d7

Tags:

trojandownloader downloader virus

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aspnet_compiler base64 evasive evasive lolbin masquerade obfuscated obfuscated powershell reconnaissance repaired

Link:

https://www.filescan.io/uploads/699d4dbc10e80629d4efb14d/reports/b5c5dcf7-660b-4db0-b6ff-9ced9d451cb8/overview

Hybrid Analysis Malware.U.XWorm

Verdict:

Malicious

Labled as:

Malware.U.XWorm

Link:

https://www.hybrid-analysis.com/sample/d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

7z

Link:

https://opentip.kaspersky.com/d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be/results?tab=lookup

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d26212276f5c5af964c52d22f10ee7848598bb96da5da27c11c32019d251e0be/

ReversingLabs TitaniumCloud Script.Trojan.Heuristic

Threat name:

Script.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-02-19 13:11:21 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

11 of 36 (30.56%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jrbej3plrnpszgffurpcdxhqsczro4w3jo2e7arymqbtusr4c7a._file

Hatching Triage xworm

Result

Malware family:

xworm

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xworm discovery execution rat trojan

Link:

https://tria.ge/reports/260224-hz14ases4a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Detect Xworm Payload

Xworm

Xworm family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.