MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292
SHA3-384 hash: b5c2a3042880dd3f13f03e58bae81bde040cf747347f860d382b5abfdfe93255dc60dcbe594fd4dce20833dfed2cb571
SHA1 hash: dd402a3ff43f69bddfaaa3bb1fb26cbeb5b0b353
MD5 hash: 3720d7f15181bfff196de27a81f080d0
humanhash: october-floor-bluebird-idaho
File name:SecuriteInfo.com.Other.Malware-gen.55432982
Download: download sample
File size:61'440 bytes
First seen:2026-07-19 08:51:14 UTC
Last seen:2026-07-19 09:22:04 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 768:8P1hnNGAkeWMDCOGM3jShfS0huDfObgdvXpJtXwGlGbp3Q8W2VWr2hfS0h:2/NGxoDRx3280hubOoXPl8pAb280h
TLSH T1BC534F3AD630FC91C75D327086661D9A21A86D56D7B30E64DB093DFE3D32780EF26688
TrID 86.8% (.MSI) Microsoft Windows Installer (454500/1/170)
11.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
1.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter SecuriteInfoCom
Tags:msi

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
FR FR
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c6172690-1458-46b6-a689-cc55c14377de/
Detection(s):
MiscreantPunch.EvilMacro.PowerShellEnc.1.UNOFFICIAL
Create hunting rule

YARA.SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5c9018bcffb2c48cb77ff0
Tags:
ransomware crypted dropper
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer
Link:
https://www.filescan.io/uploads/6a5c9013abef429e5d92f037/reports/39343d58-bafc-4ea6-a2a1-f6385dd67324/overview
Verdict:
Malicious
Labled as:
ABTrojan.KGUU
Link:
https://www.hybrid-analysis.com/sample/1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292
Verdict:
Malicious
File Type:
msi
First seen:
2026-07-07T19:56:00Z UTC
Last seen:
2026-07-20T03:38:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292/results?tab=lookup
Score:
45%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292
Verdict:
Malware
YARA:
5 match(es)
Tags:
DeObfuscated Obfuscated Office Document PowerShell T1027 T1059.001 T1059.005 VBScript
Link:
https://app.malva.re/file/3720d7f15181bfff196de27a81f080d0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292/
Threat name:
Document-OLE.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-10 03:13:00 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
8 of 20 (40.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6k7qko472shzrp7peqs2kyievgevt3rzjycmpnp3n5jvnoackja._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260719-ksemtsfz7p/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PowerShell_in_Word_Doc_RID2FBC
Create hunting rule
Author:Florian Roth
Description:Detects a powershell and bypass keyword in a Word document
Reference:Internal Research - ME
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:SUSP_PS1_JAB_Pattern_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable
Reference:Internal Research
Rule name:WIN_FileFix_Detection
Create hunting rule
Author:dogsafetyforeverone
Description:Detects FileFix social engineering technique that launches chained PowerShell and PHP commands from file explorer typed paths
Reference:FileFix social engineering with PowerShell and PHP commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 1f95f829dcfea47cc5ff79212d2b08254c4acf71ca70263dafdb7a9ab5c01292

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3888557/
  
Delivery method
Distributed via web download

Comments