MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17f4d896ce7df57aa9d84d20f01ecbcbdaad35c8c6e8f8ccd4a0bd1bec674b1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 5 File information Comments

SHA256 hash:	17f4d896ce7df57aa9d84d20f01ecbcbdaad35c8c6e8f8ccd4a0bd1bec674b1e
SHA3-384 hash:	ba4330114a78da77c6993b01ab88691a94384fe1bce65874f653ee8218df8624658481eb19bf280d5f0d8b0019992607
SHA1 hash:	029dac5ae9a3cbd965f81a5aa0231f3369fec0bc
MD5 hash:	04f7bd0e0421d35794358c95dbea68f5
humanhash:	monkey-west-mockingbird-aspen
File name:	2.zip
Download:	download sample
File size:	211'862 bytes
First seen:	2026-10-18 12:48:17 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: 1523
ssdeep	3072:LOjWZSzGHMCFF6a2p4BojHe8/uLHTAXBhW9C6N/9rSfpmBCXhXrzLkiNgsvt:LBSRg6RpYoj+8/OT2or7GaCxXznNgsl
TLSH	T1DF242305AC49C2B2D4C218B70CD208BA0E9F75D56DA0DF215B4A8E587D1AC93F8EA7DC
Magika	zip
Reporter	NDA0E
Tags:	pw-1523 zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: 1523

This file archive contains 1 file(s), sorted by their relevance:

File name:	2.exe
File size:	623'104 bytes
SHA256 hash:	c9a81c15a982007cc2c543093cf950121e1b6763088843321444a858f140b96e
MD5 hash:	b11cde1c74198f44709c83107d04a971
MIME type:	application/x-dosexec

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ad8c5597-ab3a-4121-83c3-a754adbd6dfe/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad4c04c8ce34a8cc3c93e5b

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/17f4d896ce7df57aa9d84d20f01ecbcbdaad35c8c6e8f8ccd4a0bd1bec674b1e

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Zip Archive

Link:

https://app.malva.re/file/04f7bd0e0421d35794358c95dbea68f5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/17f4d896ce7df57aa9d84d20f01ecbcbdaad35c8c6e8f8ccd4a0bd1bec674b1e/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c72nrfwopx2xvkoyjuqpahwlzpnk2noiy3uprtguuc6rx3dhjmpa._file

Result

Malware family:

n/a

Score:

4/10

Tags:

n/a

Link:

https://tria.ge/reports/261018-qngjhsxy5l/

Behaviour

Checks for VirtualBox DLLs, possible anti-VM trick

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/17f4d896ce7df57aa9d84d20f01ecbcbdaad35c8c6e8f8ccd4a0bd1bec674b1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.