🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707
SHA3-384 hash: b07df116ea66e4636e6980c4c277cb5d2936e74f3ecf1ffb29ffd08db5bd698eecf4b66f1247c1a6890d1e4d59da2646
SHA1 hash: cab28e14e4d218aefc4c21cff619baa1f0bf81e2
MD5 hash: 8172c3fadaf74201b2d7178706dfe191
humanhash: failed-early-early-lithium
File name:106600037009 Proforma.pdf
Download: download sample
File size:1'131'520 bytes
First seen:2026-05-08 09:20:59 UTC
Last seen:2026-06-08 09:22:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'272 x AgentTesla, 20'616 x Formbook, 12'394 x SnakeKeylogger)
ssdeep 24576:HnNr5v67DQec9zqmTXz8Ks8kcLSqOSBPWX+2qwK4kjPLHWMlRl:tdv63lvc+q3BP6+IK4CPDWM
TLSH T1E0352209551CCB42D0665BB01EA9E0B0637C5D9EE620D643AFD6BEFFF1B93A01489363
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter abuse_ch
Tags:exe pdf

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/8f2ee6e6-699a-48db-b6b1-468f320c8a5d/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-05-08 09:31:50 UTC
Tags:
netreactor stealer exfiltration smtp auto-startup purehvnc
Link:
https://app.any.run/tasks/d5907324-9001-43ce-828e-890bfd39cebf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/64856/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.87654959.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 masquerade packed snakekeylogger unsafe vbnet
Link:
https://www.filescan.io/uploads/69fdab1786e92bda702436c8/reports/46fbcce1-3c82-4e69-b926-5836064f1c88/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-08T02:41:00Z UTC
Last seen:
2026-05-10T06:01:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/cdf0619f-fd78-4ff5-8b98-a6308d5d35f3
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1910569
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1910569 Sample: 106600037009 Proforma.pdf.exe Startdate: 08/05/2026 Architecture: WINDOWS Score: 100 60 Multi AV Scanner detection for submitted file 2->60 62 Yara detected MSIL Injector 2->62 64 Yara detected UAC Bypass using CMSTP 2->64 66 9 other signatures 2->66 8 106600037009 Proforma.pdf.exe 3 2->8         started        12 106600037009 Proforma.pdf.exe 2 2->12         started        process3 file4 42 C:\...\106600037009 Proforma.pdf.exe.log, ASCII 8->42 dropped 68 Found many strings related to Crypto-Wallets (likely being stolen) 8->68 70 Injects a PE file into a foreign processes 8->70 14 106600037009 Proforma.pdf.exe 15 5 8->14         started        18 106600037009 Proforma.pdf.exe 8->18         started        20 106600037009 Proforma.pdf.exe 4 12->20         started        signatures5 process6 dnsIp7 58 64.89.160.73, 49692, 49693, 49694 DIXIE-NETUS United States 14->58 72 Tries to steal Mail credentials (via file / registry access) 14->72 74 Found many strings related to Crypto-Wallets (likely being stolen) 14->74 76 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->76 84 2 other signatures 14->84 22 chrome.exe 3 14->22         started        25 chrome.exe 2 14->25 injected 27 chrome.exe 2 14->27 injected 78 Tries to harvest and steal browser information (history, passwords, etc) 20->78 80 Writes to foreign memory regions 20->80 82 Tries to harvest and steal Bitcoin Wallet information 20->82 29 chrome.exe 20->29         started        31 chrome.exe 20->31 injected 33 chrome.exe 20->33 injected 35 3 other processes 20->35 signatures8 process9 dnsIp10 56 192.168.2.8, 138, 443, 49211 unknown unknown 22->56 37 chrome.exe 22->37         started        40 chrome.exe 29->40         started        process11 dnsIp12 44 www.google.com 142.251.155.119, 443, 49701, 49706 GOOGLEUS United States 37->44 46 googlehosted.l.googleusercontent.com 192.178.155.132, 443, 49711 GOOGLEUS United States 37->46 52 3 other IPs or domains 37->52 48 142.251.157.119, 443, 49739, 49742 GOOGLEUS United States 40->48 50 172.253.122.132, 443, 49744, 49745 GOOGLEUS United States 40->50 54 3 other IPs or domains 40->54
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.35 Win 32 Exe x86
Link:
https://app.malva.re/file/8172c3fadaf74201b2d7178706dfe191
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707/
Threat name:
ByteCode-MSIL.Trojan.SnakeKeylogger
Create hunting rule
Status:
Malicious
First seen:
2026-05-08 06:05:13 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eab3wjh3u2sqk4f7ns66zscfjgu46r4et76nkjikrnjza5i4k4dq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection discovery spyware stealer
Link:
https://tria.ge/reports/260508-lc9zgaat3j/
Behaviour
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Drops startup file
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707
MD5 hash:
8172c3fadaf74201b2d7178706dfe191
SHA1 hash:
cab28e14e4d218aefc4c21cff619baa1f0bf81e2
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
SH256 hash:
3909167dcfe244bb2926e31fc9172548ba705a94c4a3a4389e4357399b40ab9c
MD5 hash:
47358ef03cbbb74c6e1051c79fc21124
SHA1 hash:
5b0cee1571e047b566127e11ccb2f6a9284b1106
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
SH256 hash:
4d1e36fcad032c6b61b4b8e68728c16e43c491493e742c1b000ef9b685423670
MD5 hash:
2e5970cf1a1f82448727f08286340c55
SHA1 hash:
9675bff8d5aa3b464012e936ca9751930712890c
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
SH256 hash:
caebf12cf2229d84b4fabdf412326d127d2d9fef20e6ec54198ace170e5110e7
MD5 hash:
0d7d14bd5d98367a66ae34fdaefefab7
SHA1 hash:
c6e7e12d4f2ff0a7faaa92d677b88633bcd8ebcb
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
SH256 hash:
58624e6e471365e4fdd46e611039a3df8559401252006a102d7c361666d60011
MD5 hash:
d8c2aa23ae105a3601791e0c4c2e07c4
SHA1 hash:
3b05dd08d05819469b8d5c40d3b0c7df3e42ab77
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
SH256 hash:
06d6a74795b10232ffcbe6b19ebb1de0604ac733db51b20a4d17a85bd1dfde2c
MD5 hash:
bcda41be69790f9e95f039738d91ab94
SHA1 hash:
b0078a9c44e72430e8dcbcade5d540d422ffa76d
Link:
https://www.unpac.me/results/27d5ea4d-a772-42d4-ae73-2ffb8e3c4337/
Malware family:
PureRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/2003bb24fba6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.97
Link:
https://yomi.yoroi.company/submissions/2003bb24fba6a50570bf6cbdecc84549a9cf47849ffcd5250a8b5390751c5707

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/64856/

Comments