MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10
SHA3-384 hash: 0a1a9741f0fbfda47bfe922edf8db7c102de4c785ccf2def0f359f63dcacf381734cf1631654268d6191d74c49fd5a25
SHA1 hash: c3c3294bcadf03be23ea7a33f47dd279a2e54cfd
MD5 hash: 0112083f2976f483fc50c9dba8c0434b
humanhash: arizona-wisconsin-beryllium-music
File name:PSBBmYYA.exe
Download: download sample
File size:4'947'740 bytes
First seen:2026-01-30 09:47:41 UTC
Last seen:2026-01-30 10:43:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:dX8sk53zp0/8Iro9EWFkorsuvsa5NxrgalEfJs4XcjhnvHa3IGhgPYd394SYSF9:dqZCfJs4X2hfa3IGTd394SY49
TLSH T1B8364B63ADB491E8C0AFF0789861F152E660784843353AD75FD04BE10F6BBC552BBB1A
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
120
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/50822/
Detection(s):
SecuriteInfo.com.Trojan.PWS.Vidar.178.27569.1962.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=697c7e7897ed63deecb49045
Tags:
injection
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10
Verdict:
Clean
File Type:
exe x64
Link:
https://opentip.kaspersky.com/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/33171efc-b43d-4547-8f37-459a69a762db
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1860332
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
73%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fgraoonpsy7luckhpdvfaohhvoas7nuhvbjktwkofegwtf6m3yia._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260130-ls3v4agt2d/
Unpacked files
SH256 hash:
29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10
MD5 hash:
0112083f2976f483fc50c9dba8c0434b
SHA1 hash:
c3c3294bcadf03be23ea7a33f47dd279a2e54cfd
Link:
https://www.unpac.me/results/642e6e10-abb9-4bc8-a7af-97135c83e135/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:Golang_Find_CSC846
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:Golang_Find_CSC846_Simple
Create hunting rule
Author:Ashar Siddiqui
Description:Find Go Signatuers
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:Suspicious_Golang_Binary
Create hunting rule
Author:Tim Machac
Description:Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 29a20739af963eba094778ea5038e7ab812fb687a852a9d94e290d6997ccde10

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3733127/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/50822/

Comments