MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d
SHA3-384 hash:	0f25bb04d54831766cc8e1ca4aca9f27f7d01d64e2fb46a331ab66d4cda8f03bed2cbf1a23cf4e783d93a72c5efda515
SHA1 hash:	2f91ba64781a381775791eec67de6a1821c3bf77
MD5 hash:	c8f89077cd2c9f38290b08098bb55e0a
humanhash:	lithium-sodium-queen-alaska
File name:	em_HscTfWi9_installer_beta.msi
Download:	download sample
File size:	98'381'824 bytes
First seen:	2026-02-13 09:38:09 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:bf0o8POL7GuD111/Vppai6GpRZ0xWGFCxgN+IzNcBfAalvuajRwNSzV7Cnb0omo:b0oU26q/PQogxtF8gwC+BIap7RqPb0oR
TLSH	T1EC283312F07195E7C9B72531CC7BEA1656A8BD276B104CA7AFF4371F24362C32A32646
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	juroots
Tags:	msi signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

28

Origin country :

US

Vendor Threat Intelligence

ACCE MSI_FileType

Details

Link:

https://research.acce.ciphertechsolutions.com/results/6b26b6da-0938-4d69-9bb7-7194e2be3090/

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=698ef12776589225f6664697

Tags:

n/a

Hybrid Analysis Malicious

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d

InQuest SUSPICIOUS

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

msi

First seen:

2023-08-14T10:42:00Z UTC

Last seen:

2026-02-13T07:37:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1850056

Signature

Leaks process information

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

2%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d

CERT.PL MWDB

Gathering data

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/439fd38ec145740ae91161687d017636ddae0323dae6a970ab444cde1d6b151d

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iop5hdwbiv2av2irmfuh2alwg3o24azd3ltks4flirgn4hllcuoq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260213-ll91tsax9h/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Adds Run key to start application

Badlisted process makes network request

Enumerates connected drives

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.