🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e405cd28670247ade927859cd6f3badc69f2d1845d6a5480d088795cee693a35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e405cd28670247ade927859cd6f3badc69f2d1845d6a5480d088795cee693a35
SHA3-384 hash: 94cdb3c5370f724a9e2a7b7f11d11eb885ea5f74ff322897b662f310ac30facc6214d1db7974fb0e2544cb6cc2180b2e
SHA1 hash: 0757638e63e5a87f7075f1c6f63e90bf746033ca
MD5 hash: 10c2ac9d4cc6c6a9f683ea34a2da014c
humanhash: minnesota-mountain-crazy-william
File name:WP.jar
Download: download sample
File size:3'860 bytes
First seen:2026-11-14 06:53:04 UTC
Last seen:Never
File type:Java file jar
MIME type:application/java-archive
ssdeep 96:jKJ7tyMq4yLW5+cOraZbbFAw8DuDOJSyk61Sdxase:O32W4chbUDumSOSz2
TLSH T169812A2A0ED4D5FAD70F4E759781623BD4A9248C685C900B1BBE0C790C739123BA86F9
TrID 77.1% (.JAR) Java Archive (13500/1/2)
22.8% (.ZIP) ZIP compressed archive (4000/1)
Magika jar
Reporter Latin

Intelligence

File Origin
# of uploads :
1
# of downloads :
8
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99953/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af805640a71acf937da83eb
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e405cd28670247ade927859cd6f3badc69f2d1845d6a5480d088795cee693a35
Result
Malware family:
n/a
Verdict:
Suspicious
Trusted hash?:
False
File:
3
Classes:
2
Nested archives:
0
Source:
https://www.jarscanner.org/
Findings
User-Agent: May indicate outbound HTTP requests or client impersonation.
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/2005846
Signature
Connects to many different private IPs (likely to spread or exploit)
Joe Sandbox ML detected suspicious sample
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 2005846 Sample: WP.jar Startdate: 14/11/2026 Architecture: WINDOWS Score: 48 20 Joe Sandbox ML detected suspicious sample 2->20 6 cmd.exe 1 2->6         started        process3 process4 8 java.exe 4 6->8         started        12 conhost.exe 6->12         started        dnsIp5 14 192.168.1.108, 80 unknown unknown 8->14 16 192.168.1.109, 80 unknown unknown 8->16 18 33 other IPs or domains 8->18 22 Connects to many different private IPs (likely to spread or exploit) 8->22 signatures6
Score:
0%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/e405cd28670247ade927859cd6f3badc69f2d1845d6a5480d088795cee693a35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e405cd28670247ade927859cd6f3badc69f2d1845d6a5480d088795cee693a35/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4qc42kdhajd232jhqwonn4523ru7fumelvvfjagqrb4vz3tjhi2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261114-hnwdnsdz6z/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:JAVA_Malware_Unknown_ForgeAuto_0ece8eba
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)
Rule name:JAVA_Malware_Unknown_ForgeAuto_6c4b5896
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (class, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/99953/

Comments