MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0
SHA3-384 hash: 5a027f355c4837b2689d5322c7442ab53d0bab9cc024d85daf511eeeb994c1386372e29eefb8d1f354e1e8944bc5bc0a
SHA1 hash: dc2f181b338e1cd0d913a7a3b2e9aee0080904a7
MD5 hash: 30fc82db8a87e9da2b8180f8e91b0259
humanhash: summer-bravo-carpet-low
File name:book.py
Download: download sample
File size:39'561 bytes
First seen:2025-04-09 12:54:40 UTC
Last seen:Never
File type:
MIME type:text/plain
ssdeep 768:KbdUhtvz71Z5UrNjytiptPFRYT9CrXG2o2OOP0BKm1xJ8kMup0UpBhyTjW6SSsoc:KbdUJPkKiz8xCrTcY0BKmvJ8zuprh6LM
Threatray 49 similar samples on MalwareBazaar
TLSH T14003F2F99B7AFECD09A42416E6964D0C16FE017429570467578C2C317BEAD0C14E78FA
Magika powershell
Reporter JAMESWT_WT
Tags:cdn-jsdelivr-net py werito-cyou

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
IT IT
Vendor Threat Intelligence
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67f672b371beff15dcce23ef
Tags:
virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/67f66e3140adfb5162bd6e25/reports/d8ff4ea1-9e42-4b85-b951-048d30c6e604/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-04-08 04:04:18 UTC
File Type:
Text
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cdffvydvumvevgm6z7paiwrtmfajegayebfo45a7oretdkytowqa._file
Verdict:
malicious
Label(s):
idatloader
Create hunting rule
Similar samples:
06be76f549d1d97a808e6629f6043a9609d5b59fa14d0e3ee3aa01354ac369d1
13c1c521c750eba944d9961b8c35c9ca2f98f60c4cadbd764a6784f714c05373
2d8e86b6f8aa26d52f7aa5b4e269b43b4357b3414b46158dd8f5e9c084d6ceb8
34a4212ab10d2edc6a8894cc368807279fc7c200aec606c18eb6a0bf21350cb5
411e6413afc5dadc63f69dd37d25f23dfee1fbd5eff1a591ba33dfc38ca5a4fd
69379eb25e5632a3e1b4361985a6e894e0c73e297201d2f4d2519c1491a3970b
d5e8c736723b1331e51ab7f5ce3d39a312c2d8274c138c0c26c1a3823041ba8b
dabfe2b02c36b5f1a7f1c0d96798c944f69f84c4889e2e7e25655bb4d3894f31
e63d9d50fca4b99b2a08f745b23e0dec021bc46b3dcd33ec081dcdea3f7365a9
error
+ 39 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250409-p5v8ka1jx5/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/10ca5ae075a32a4a999ecfde045a336140921818204aee741f744931ab1375a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments