MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c
SHA3-384 hash:	7eaa94f1279cdf84e47a2298b73f8a5aa65cf798895b8b62c319dc0b533d3ae12b8915f34fe1e58a287cef549daed0d8
SHA1 hash:	4dd7e528c48304c18787f336dcb7c2fe183d1d8e
MD5 hash:	640bc5ea8ac5f0eea80e66a9d20341b1
humanhash:	zebra-jersey-papa-kitten
File name:	pko_trans_details_20250923_124546,pdf.cmd
Download:	download sample
Signature	GuLoader Alert Create hunting rule
File size:	4'889 bytes
First seen:	2025-10-07 10:56:19 UTC
Last seen:	2025-10-09 09:22:13 UTC
File type:	cmd
MIME type:	text/plain
ssdeep	96:4JLnC3DOtPU6p095tleW5NX/ce9TtgH5mJezghqUOe1uab:4BiD0Prp09/leW5NvceQZmYghqUOpo
TLSH	T19AA1637955C63F3EDFCB08A55036C487FA4A01BE4F2A0EF1841FA0B775DA74C6189A94
Magika	powershell
Reporter	Anonymous
Tags:	cmd GuLoader

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

122

Origin country :

PL

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e4f1e2277c2bd8bc5d5b73

Tags:

shell virus sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

base64 obfuscated powershell

Link:

https://www.filescan.io/uploads/68e4f1def377ab23105364fa/reports/70bac65b-0fc7-4ec7-aeba-f078117dc12f/overview

Hybrid Analysis BAT/Agent.BDZ1

Verdict:

Suspicious

Labled as:

BAT/Agent.BDZ1

Link:

https://www.hybrid-analysis.com/sample/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-10-07T03:33:00Z UTC

Last seen:

2025-10-09T08:56:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c/results?tab=lookup

Joe Sandbox GuLoader

Result

Threat name:

GuLoader

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1790536

Signature

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Malicious sample detected (through community Yara rule)

Obfuscated command line found

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Sigma detected: Potential PowerShell Command Line Obfuscation

Suspicious powershell command line found

Yara detected GuLoader

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c

ReversingLabs TitaniumCloud Script.Trojan.Malgent

Threat name:

Script.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-07 08:31:47 UTC

File Type:

Text

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7w7tjxkidfgutxqo3vkjpd5hr4rss67rl6n2is3f2qnayqz4w4oa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

n/a

Link:

https://tria.ge/reports/251007-m1yf1swms9/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fdbf34dd48194d49de0edd54978fa78f23297bf15f9ba44b65d41a0c433cb71c