MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f
SHA3-384 hash:	e4e4f3c96cd761807454e8df1fefd94522ad2aecc3d5b888f2d456b75d95577d9105268297fa04bd407378a090e33ed6
SHA1 hash:	5689c301e8d17fc0fba1beda0588badaf70133fd
MD5 hash:	8a913932960ebdc102af92254751d7f4
humanhash:	oven-jupiter-eleven-bluebird
File name:	DOC07282026.zip
Download:	download sample
File size:	261'756 bytes
First seen:	2026-07-29 12:15:45 UTC
Last seen:	2026-08-03 11:23:08 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:VPoI2RHI8j4Gp9/C2dbHHO8qdnNtD5P848AW7kIh:VPoI2xrp9Djurnvy48AWV
TLSH	T1084423F9F4AE4502E14504D090950B6C4BAF7FA0D287587DE87E9D5C230EF19E68AAFC
Magika	zip
Reporter	TomU
Tags:	zip

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

107

Origin country :

CH

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Other files 1

File name:	DOC07282026.js
File size:	1'288'520 bytes
SHA256 hash:	946243289414d475c5fba55850ae2e7e9bb56717ea1bd8ee765da36455df9b2b
MD5 hash:	13339c900ef07a4a4bbb1e289359e6d1
MIME type:	text/plain

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a6d7749d-df32-4c80-be41-28b28889a3ac/

ClamAV Detected

Detection(s):

Sanesecurity.Foxhole.Zip_fs1543.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Zip_fs237.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Zip_fs154.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Foxhole.Zip_JsNum.v2.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

JS File - Malicious

Link:

https://app.docguard.net/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f/results/dashboard

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

aes base64 base64 cmd conhost crypto encrypted lolbin obfuscated overlay powershell repaired

Link:

https://www.filescan.io/uploads/6a69ef17de874a2a5ae0ab54/reports/f2dba36b-fad5-453e-882c-0d6b8cae9978/overview

Hybrid Analysis Mal/DrodZp

Verdict:

Suspicious

Labled as:

Mal/DrodZp

Link:

https://www.hybrid-analysis.com/sample/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

zip

First seen:

2026-07-28T11:13:00Z UTC

Last seen:

2026-07-30T19:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f/results?tab=lookup

Nucleon Malprob Malware

Score:

70%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/8a913932960ebdc102af92254751d7f4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f/

ReversingLabs TitaniumCloud Script-JS.Downloader.Nemucod

Threat name:

Script-JS.Downloader.Nemucod

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-29 12:17:49 UTC

File Type:

Binary (Archive)

Extracted files:

1

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7gxoxg5rgfovgflhwh6cshkgeom2i26wd5cgzcu2nqn43jmsge7q._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

execution

Link:

https://tria.ge/reports/260729-r2a5bshh65/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: JavaScript

Enumerates physical storage devices

Executes a command shell one-liner

Checks computer location settings

Badlisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f