MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3
SHA3-384 hash:	21517a28281f1097d6d5fc57b3c4fe45009fbcb83870f4269b9b07fa2389f36e7e47730a9c45ec98ae825790325dc0d4
SHA1 hash:	650bd71840384aa9b42b8678c9a47fece1755e2c
MD5 hash:	5b84ad7b1743603f59779f9146184e91
humanhash:	diet-wolfram-yankee-johnny
File name:	Sales Order - Order Confrimation VTR 1000030878526 - 0061-27-EXOL-Q_pdf.txz
Download:	download sample
File size:	115'220 bytes
First seen:	2026-05-13 19:32:35 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	3072:CpM7QpiyKLe/XoiKwqbiK645MVxdSPIDL/:C278zXaBb3645wxIPw/
TLSH	T1B2B3125B37EA83001D817F7CF128921BB2FB77482061536BEB4D96B4B88919C4B45F67
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Magika	rar
Reporter	JAMESWT_WT
Tags:	5-101-84-202 everycarebd-com rar Spam-ITA

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

42

Origin country :

IT

Vendor Threat Intelligence

ACCE Rar_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/358d0c20-f46e-44ef-91d2-91c4a06c00e5/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.JS_Rar_1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a04d1f6953bbcef1c9027f4

Tags:

n/a

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

rar

First seen:

2026-05-13T10:09:00Z UTC

Last seen:

2026-05-14T06:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3/results?tab=lookup

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

1 match(es)

Tags:

Rar Archive

Link:

https://app.malva.re/file/5b84ad7b1743603f59779f9146184e91

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3/

Neiki Exploit.Win32

Verdict:

Malicious

Threat:

Exploit.Win32

Link:

https://tip.neiki.dev/file/df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3

ReversingLabs TitaniumCloud Win32.Trojan.Egairtigado

Threat name:

Win32.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-13 19:20:09 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=34i25jhih6e2t625rlxyjzplwaalsfdeht6piaorgxcjec4h62rq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/df11aea4e83f89a9fb5d8aef84e5ebb000b914643cfcf401d135c4920b87f6a3