MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 0e89c004a33aa95ad09efe0e22ff9d424911405e0f7e58d4cd53e4d503d03bf7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 10
| SHA256 hash: | 0e89c004a33aa95ad09efe0e22ff9d424911405e0f7e58d4cd53e4d503d03bf7 |
|---|---|
| SHA3-384 hash: | 45f8a4a6d079940f7b8483a6ea06b96224d37089a39f413e6ead38d3a1984f89ec48701fdb6e0834b7c404384316d3e3 |
| SHA1 hash: | 0e463bf03ed9675fa63fe8a0249faffdc27be667 |
| MD5 hash: | 016b3f3d02b55e6729f7d363dbea92bc |
| humanhash: | cold-romeo-robin-pizza |
| File name: | keygen.exe |
| Download: | download sample |
| File size: | 81'408 bytes |
| First seen: | 2026-11-09 08:21:34 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | d618f79d0494a065da3229420de00cd5 |
| ssdeep | 1536:Jt7tKP8r9BUaNeLLHWBnmyoCmN1/ILmznbhz87MZB1z9AaFC6I:fZR9OHLbYnT0NBU0h32D6 |
| TLSH | T1148301D6A6F04FB6D114B73B748B082671F9E6396344928475FC6BAE3CBB3246E0D811 |
| TrID | 34.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 23.4% (.EXE) Win32 Executable (generic) (4504/4/1) 10.8% (.EXE) Win16/32 Executable Delphi generic (2072/23) 10.5% (.EXE) OS/2 Executable (generic) (2029/13) 10.4% (.EXE) Generic Win/DOS Executable (2002/3) |
| Magika | pebin |
| File icon (PE): |  |
| dhash icon | 60d2d2a0809ac860 |
| Reporter |  malwaress |
| Tags: | exe keygen adobe Trojen UPX |
UPX packed
This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.
| File size (compressed) : | 81'408 bytes |
|---|---|
| File size (de-compressed) : | 557'056 bytes |
| Format: | win32/pe |
| Unpacked file: | a1a0a062b3f47a1cba6b9c3fe2cc757ced32e608c3abfd488aee32c45b2b3cef |
Intelligence
File Origin
# of uploads :
1
# of downloads :
46
Origin country :
TRVendor Threat Intelligence
Malware configuration found for:
PEPacker
Details
Malware family:
n/a
ID:
1
File name:
Keygen.Backup.rar
Verdict:
Malicious activity
Analysis date:
2019-11-16 07:15:12 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
99.1%
Tags:
injection keygen virus
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating synchronization primitives
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Keygen.BH potentially unsafe application
Verdict:
Clean
File Type:
exe x32
First seen:
2011-04-29T20:07:00Z UTC
Last seen:
2026-10-16T18:01:00Z UTC
Hits:
~10000
Verdict:
Malicious
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout UPX Win 32 Exe x86
Threat name:
Win32.Worm.SpyBot
Status:
Malicious
First seen:
2011-06-30 03:55:00 UTC
File Type:
PE (Exe)
Extracted files:
23
AV detection:
30 of 36 (83.33%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
8/10
Tags:
discovery upx
Behaviour
System Location Discovery: System Language Discovery
UPX packed file
Drops file in Drivers directory
Malware Family:
n/a
Verdict:
Benign
Tags:
n/a
YARA:
n/a
Malware Family:
keygen
Malicious:
True
Tags:
upx file-overlay cpu-clock peexe runtime-modules
Unpacked files
SH256 hash:
0e89c004a33aa95ad09efe0e22ff9d424911405e0f7e58d4cd53e4d503d03bf7
MD5 hash:
016b3f3d02b55e6729f7d363dbea92bc
SHA1 hash:
0e463bf03ed9675fa63fe8a0249faffdc27be667
SH256 hash:
a1a0a062b3f47a1cba6b9c3fe2cc757ced32e608c3abfd488aee32c45b2b3cef
MD5 hash:
522a09df0df0faf12982232a3a9bba9d
SHA1 hash:
44f78f504a3455977db5acde3cef628aeaf1e6f6
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 0e89c004a33aa95ad09efe0e22ff9d424911405e0f7e58d4cd53e4d503d03bf7
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.