MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978
SHA3-384 hash:	d590c98271ac07a37adf58a9922bb0845ecbf874f3189e41d497455d6f58581011b23e383032cf03dd22957a9d8f143c
SHA1 hash:	84f5285426ceb14b5948f7902e7689938ed7f245
MD5 hash:	6d3a1ceacb1a62e9b7fe1415c7fa041c
humanhash:	ack-august-bakerloo-paris
File name:	4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978
Download:	download sample
File size:	159'744 bytes
First seen:	2026-01-31 08:03:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f9f0e87ecf133996a285a6a9b5271211
ssdeep	3072:QtdC4rFcFbux44OALpJmI03bOskb4pzJ6UaSkgzCk3WsxlU5UkyCj:QtdDpJmIgJFIIkgzcUq
TLSH	T122F36C17B3A500BBE4739239C9A30A42E772781657619BEF03A047756F673E09D3EB21
TrID	48.7% (.EXE) Win64 Executable (generic) (10522/11/4) 23.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 9.3% (.EXE) OS/2 Executable (generic) (2029/13) 9.2% (.EXE) Generic Win/DOS Executable (2002/3) 9.2% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	JAMESWT_WT
Tags:	exe hitpak-org

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978.dll

Verdict:

No threats detected

Analysis date:

2026-01-31 08:05:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/db866950-0556-46cc-b788-d521b66e0ada

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=697db78b848d0f834c8c10f3

Tags:

virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm base64 microsoft_visual_cc

Link:

https://www.filescan.io/uploads/697db788930564ff3c805e2f/reports/e1c549c9-bb68-48c3-a5cc-79a9d9be4ed6/overview

Verdict:

Suspicious

Labled as:

Malware_51.8

Link:

https://www.hybrid-analysis.com/sample/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978

Verdict:

Malicious

File Type:

dll x64

First seen:

2025-11-27T06:30:00Z UTC

Last seen:

2026-02-01T05:10:00Z UTC

Hits:

~10

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/91fd39c3-a0af-481b-8aa5-940077f8e0bd

Score:

95%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978/

Verdict:

Malicious

Threat:

DangerousObject.Multi

Link:

https://tip.neiki.dev/file/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978

Threat name:

Win64.Trojan.Midie

Status:

Malicious

First seen:

2025-11-27 11:21:36 UTC

File Type:

PE+ (Dll)

Extracted files:

AV detection:

4 of 24 (16.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jifrbvzndmzygn7n7lxtzywm2c2mjdqrhcx33vaq4pm75nvpdf4a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260131-jyfxeadv2e/

Unpacked files

SH256 hash:

4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978

MD5 hash:

6d3a1ceacb1a62e9b7fe1415c7fa041c

SHA1 hash:

84f5285426ceb14b5948f7902e7689938ed7f245

Link:

https://www.unpac.me/results/39f65d0f-c7d7-4a34-a979-444476224cef/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4a0b10d72d1b338337edfaef3ce2ccd0b4c48e1138afbdd410e3d9feb6af1978

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)