MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 03e32f965938c127a3c4478d5f065609b0e8ccd455a832bdc122d3a8627490a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 14
| SHA256 hash: | 03e32f965938c127a3c4478d5f065609b0e8ccd455a832bdc122d3a8627490a9 |
|---|---|
| SHA3-384 hash: | d586061b4d45176091e261f5fece7609022cef72287ffa24ca876edd1587107670c915d8690de0e4dc9b38ec39a734e9 |
| SHA1 hash: | fb2666508d324dc6b70a6df2b4384fbcfa18e40e |
| MD5 hash: | 68c79fa749e4fd7f300da5f8822441f5 |
| humanhash: | thirteen-papa-delta-quiet |
| File name: | Ptmiw_2025.10.05_06.24.07_SETUP.exe |
| Download: | download sample |
| File size: | 11'035'669 bytes |
| First seen: | 2025-10-05 07:12:46 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 40ab50289f7ef5fae60801f88d4541fc (60 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader) |
| ssdeep | 196608:KToMBHhc89VugUYG5BGX9PIua+Ss4HLlzRg7FZmDREYe6XqOA:KMMHhSg5G5UNPIu5SZH5unm6AA |
| Threatray | 923 similar samples on MalwareBazaar |
| TLSH | T16EB60112F78590FBE95B8231A17BA12B937276204330CEDB97948E689F76BD11D39703 |
| TrID | 62.3% (.EXE) Inno Setup installer (107240/4/30) 24.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 6.1% (.EXE) Win64 Executable (generic) (10522/11/4) 2.6% (.EXE) Win32 Executable (generic) (4504/4/1) 1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23) |
| Magika | pebin |
| Reporter |  zhuzhu0009 |
| Tags: | exe |
Intelligence
File Origin
# of uploads :
1
# of downloads :
116
Origin country :
RUVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ptmiw_2025.10.05_06.24.07_SETUP.exe
Verdict:
Malicious activity
Analysis date:
2025-10-05 07:08:44 UTC
Tags:
stealer rust
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Malicious
Score:
99.9%
Tags:
shellcode asyncrat virus spawn
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Restart of the analyzed sample
Creating a process with a hidden window
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Moving a file to the %temp% subdirectory
Launching a process
Loading a suspicious library
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling the 'hidden' option for recently created files
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 crypt embarcadero_delphi evasive fingerprint innosetup installer overlay packed unsafe zero
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-10-05T04:34:00Z UTC
Last seen:
2025-10-05T08:30:00Z UTC
Hits:
~100
Verdict:
Suspicious
Score:
94%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
.Net Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat name:
Win32.Trojan.Generic
Status:
Suspicious
First seen:
2025-10-05 07:14:34 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
13 of 24 (54.17%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
purecrypter
Similar samples:
+ 913 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
discovery execution
Behaviour
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
03e32f965938c127a3c4478d5f065609b0e8ccd455a832bdc122d3a8627490a9
MD5 hash:
68c79fa749e4fd7f300da5f8822441f5
SHA1 hash:
fb2666508d324dc6b70a6df2b4384fbcfa18e40e
SH256 hash:
6427cef8fa2f2893b53042a2394e5d3b3caa2cd15a46ed254a653e359bedf603
MD5 hash:
4c9541c602732ef6602599910cde70bc
SHA1 hash:
cb0ba87d67361fe1437c623c2e819480b7f81bbd
SH256 hash:
af18ac329e7bac4bab16b6c7508ee5e8f875ed499fd6eae7f87eaa3bc9769758
MD5 hash:
2d3c1c0d9eeed597fbb259caff754f54
SHA1 hash:
8cf3cd28f23bcd109606ff96e6f647e241a36c14
SH256 hash:
7ae892fc572d6876572235b965ed44734d5c4bfc6c4d64d4079cae816d7688a1
MD5 hash:
50756e95fb8e37e3b5ef04a385b94fba
SHA1 hash:
a7a7178caa937ccb9ee153d65291e41101829261
SH256 hash:
96a18e03947a55345f4acd1c4bab7e8b0c8fa79334ec934d44bd4c7100473966
MD5 hash:
29a88ea2408c28e5c4bdf9051912ccf6
SHA1 hash:
cf0aee7e0b82d67daff4056a1c27bccf3d299259
SH256 hash:
574a72413dea50f0adc3c59e7c658940a24cc334636088cf752095fa501501f5
MD5 hash:
effbe43ae34c67a003d6b54161415e71
SHA1 hash:
05467eb3dcde6a9d72b059fa9761daaf2f2516d7
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Borland |
|---|---|
| Author: | malware-lu |
| Rule name: | botnet_plaintext_c2 |
|---|---|
| Author: | cip |
| Description: | Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols. |
| Rule name: | CP_AllMal_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication |
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerCheck__QueryInfo |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DebuggerException__SetConsoleCtrl |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | Lumma_Stealer_Detection |
|---|---|
| Author: | ashizZz |
| Description: | Detects a specific Lumma Stealer malware sample using unique strings and behaviors |
| Reference: | https://seanthegeek.net/posts/compromized-store-spread-lumma-stealer-using-fake-captcha/ |
| Rule name: | MD5_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for MD5 constants |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | pe_detect_tls_callbacks |
|---|
| Rule name: | ProgramLanguage_Rust |
|---|---|
| Author: | albertzsigovits |
| Description: | Application written in Rust programming language |
| Rule name: | RANSOMWARE |
|---|---|
| Author: | ToroGuitar |
| Rule name: | RIPEMD160_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for RIPEMD-160 constants |
| Rule name: | SEH__vectored |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | SHA1_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA1 constants |
| Rule name: | SHA512_Constants |
|---|---|
| Author: | phoul (@phoul) |
| Description: | Look for SHA384/SHA512 constants |
| Rule name: | shellcode |
|---|---|
| Author: | nex |
| Description: | Matched shellcode byte patterns |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.