🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.OfferCore


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b
SHA3-384 hash: 35fdde93820299ba913ecee464e1c5213516c0ebfdbffe27797124e97bedda7ee3ffcc7f4e716b527fe2aa37cb88d56b
SHA1 hash: 9fcc84d21ce3ed6fd29f53fec5eb4e6c6c7b4649
MD5 hash: c78bab123cd035153467cd4b31b8ece8
humanhash: beer-eighteen-undress-king
File name:4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b.exe
Download: download sample
Signature Adware.OfferCore
Create hunting rule
File size:2'132'080 bytes
First seen:2026-10-29 00:28:59 UTC
Last seen:2026-10-29 01:20:00 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (31 x ValleyRAT, 22 x Adware.OfferCore, 21 x OffLoader)
ssdeep 24576:/XNrSLScusMmOvjjhzvL3kYVgkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64dM:0uI2h7HcTeynRkfg7ve+AhrWzOUG
TLSH T167A5D03FB28B653EE06E5A3A79B2E110583B7A6165138C5696F4C88CCF254701E3F787
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon b36494a8cca2cc4d (13 x Adware.OfferCore, 6 x RedLineStealer, 1 x RaccoonStealer)
Reporter Tuxxin
Tags:Adware.OfferCore exe signed

Code Signing Certificate

Organisation:SOFTONIC INTERNATIONAL SA
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-28T00:00:00Z
Valid to:2027-01-28T23:59:59Z
Serial number: c3607b2510e7ab39ff16c1998bbf0c85
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b1e1dbb1624601638e698d1bf0c4e080eb335e6fb4dd29df68ab6951a96452e7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1f8b6848-1150-4fa4-8019-b41a27627b96/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-29 01:13:18 UTC
Tags:
installer offercore adware innosetup delphi inno arch-exec loader arch-scr
Link:
https://app.any.run/tasks/86da5921-ec15-457b-ae44-103d84b187b9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95808/
Detection(s):
SecuriteInfo.com.Adware.Downware.20879.8068.2779.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae2935eb175ade21dce7113
Tags:
softonic delphi
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader embarcadero_delphi inno installer installer obfuscated signed
Link:
https://www.filescan.io/uploads/6ae29359d075215ae94bd290/reports/005c7ce4-4047-4efa-9ec6-248dfd2c7575/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b
Verdict:
Adware
File Type:
exe x32
First seen:
2026-10-30T17:24:00Z UTC
Last seen:
2026-10-30T17:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/de85fea9-fd99-4b78-a62f-5038476580b1
Result
Threat name:
n/a
Detection:
suspicious
Classification:
rans.evad
Score:
34 / 100
Link:
https://www.joesandbox.com/analysis/1994326
Signature
Contains functionality to infect the boot sector
Detected potential unwanted application
Installs a global event hook (focus changed)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1994326 Sample: 1cxMKshqDP.exe Startdate: 29/10/2026 Architecture: WINDOWS Score: 34 159 images.sftcdn.net 2->159 161 honzik.avcdn.net 2->161 163 28 other IPs or domains 2->163 187 Multi AV Scanner detection for submitted file 2->187 189 Detected potential unwanted application 2->189 12 1cxMKshqDP.exe 2 2->12         started        15 svchost.exe 2->15         started        17 svchost.exe 2->17         started        19 6 other processes 2->19 signatures3 process4 dnsIp5 135 C:\Users\user\AppData\...\1cxMKshqDP.tmp, PE32 12->135 dropped 22 1cxMKshqDP.tmp 6 24 12->22         started        27 MpCmdRun.exe 15->27         started        29 WerFault.exe 17->29         started        31 WerFault.exe 17->31         started        165 127.0.0.1 unknown unknown 19->165 file6 process7 dnsIp8 167 151.101.1.91, 443, 49716 FASTLY-FastlyIncUS Canada 22->167 169 swls.map.fastly.net 151.101.65.91, 443, 49711 FASTLY-FastlyIncUS Canada 22->169 171 d2it9arwsniqaq.cloudfront.net 3.170.21.180, 443, 49706, 49707 AMAZON-02-AmazoncomIncUS United States 22->171 103 canon-ij-scan-util...1.0.5-installer.exe, PE32 22->103 dropped 105 C:\Users\...\cookie_mmm_irs_ppi_008_585.exe, PE32 22->105 dropped 107 canon-ij-scan-util...nstaller.exe (copy), PE32 22->107 dropped 109 5 other files (2 malicious) 22->109 dropped 195 Writes many files with high entropy 22->195 33 cookie_mmm_irs_ppi_008_585.exe 6 42 22->33         started        38 canon-ij-scan-utility-1.0.5-installer.exe 22->38         started        40 OperaSetup.exe 2 22->40         started        44 2 other processes 22->44 42 conhost.exe 27->42         started        file9 signatures10 process11 dnsIp12 155 cdip.cdippd.nortonalto.com 100.58.11.116, 443, 49719, 49721 AMAZON-AES-AmazoncomIncUS United States 33->155 157 e337078.dscd.akamaiedge.net 2.18.177.227, 443, 49718 AKAMAI-ASN1NL United States 33->157 85 C:\Windows\Temp\...\icarus.exe, PE32+ 33->85 dropped 87 C:\Windows\Temp\...\setupui.cont, XZ 33->87 dropped 89 C:\...\fe80340b-2464-4610-8782-1cc4b40be35d, LZMA 33->89 dropped 99 9 other files (5 malicious) 33->99 dropped 191 Contains functionality to infect the boot sector 33->191 193 Writes many files with high entropy 33->193 46 icarus.exe 33->46         started        91 C:\Users\user\AppData\Local\...\SETUP.exe, PE32 38->91 dropped 93 C:\Users\user\AppData\Local\...\SETUP.exe, PE32 38->93 dropped 95 C:\Users\user\AppData\Local\...\SETUP.exe, PE32 38->95 dropped 101 6 other malicious files 38->101 dropped 51 SETUP.exe 38->51         started        53 SETUP.exe 38->53         started        55 SETUP.exe 38->55         started        97 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 40->97 dropped 57 installer.exe 82 40->57         started        file13 signatures14 process15 dnsIp16 173 8.8.8.8 GOOGLE-GoogleLLCUS United States 46->173 175 34.160.176.28 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 46->175 181 4 other IPs or domains 46->181 137 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 46->137 dropped 139 C:\Windows\Temp\...\icarus_product.dll, PE32+ 46->139 dropped 141 C:\Windows\Temp\...\icarus.exe, PE32+ 46->141 dropped 145 13 other files (8 malicious) 46->145 dropped 185 Writes many files with high entropy 46->185 59 icarus.exe 46->59         started        63 icarus.exe 46->63         started        147 80 other files (2 malicious) 51->147 dropped 149 71 other files (1 malicious) 53->149 dropped 151 71 other files (1 malicious) 55->151 dropped 177 submit-trn.osp.opera.software 107.167.125.189, 443, 49724, 49725 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 57->177 179 trn.lb.opera.technology 107.167.96.30, 443, 49727 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 57->179 183 8 other IPs or domains 57->183 143 C:\Users\user\AppData\Local\...\opera_package, PE32 57->143 dropped 153 5 other files (2 malicious) 57->153 dropped 65 installer.exe 57->65         started        67 Assistant_136.0.6008.52_Setup.exe_sfx.exe 57->67         started        69 assistant_installer.exe 57->69         started        71 2 other processes 57->71 file17 signatures18 process19 file20 111 C:\...\gaming_hook.exe.ipending.ac5a071e, PE32 59->111 dropped 113 C:\...\dnd_helper.dll.ipending.ac5a071e, PE32 59->113 dropped 115 C:\...\aswhook.dll.ipending.ac5a071e, PE32 59->115 dropped 121 222 other files (150 malicious) 59->121 dropped 197 Writes many files with high entropy 59->197 117 C:\...\uiext.dll.ipending.5b8b0a20, PE32+ 63->117 dropped 123 172 other files (137 malicious) 63->123 dropped 73 engsup.exe 63->73         started        119 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 65->119 dropped 125 31 other files (14 malicious) 65->125 dropped 75 installer.exe 65->75         started        79 installer.exe 65->79         started        127 4 other files (none is malicious) 67->127 dropped 81 assistant_installer.exe 69->81         started        signatures21 process22 file23 129 C:\Users\user\AppData\Local\...\opera.exe, PE32+ 75->129 dropped 131 C:\Users\user\...\opera_autoupdate.exe, PE32+ 75->131 dropped 133 opera_autoupdate.e...93239667.old (copy), PE32+ 75->133 dropped 199 Installs a global event hook (focus changed) 75->199 201 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 75->201 83 installer.exe 75->83         started        signatures24 process25
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/c78bab123cd035153467cd4b31b8ece8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b/
Threat name:
Win32.PUA.OfferCore
Create hunting rule
Status:
Suspicious
First seen:
2026-10-28 20:11:05 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
11 of 24 (45.83%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jixsptmwjkk5kjdsnhsr5qxtzflph7wmlccft5gbch5awwmlrifq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
bootkit defense_evasion discovery installer persistence spyware stealer
Link:
https://tria.ge/reports/261029-as231svy7r/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Direct Volume Access: Opens a physical disk for reading
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Checks for any installed AV software in registry
Checks installed software on the system
Enumerates connected drives
Writes to the Master Boot Record (MBR)
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Unpacked files
SH256 hash:
4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b
MD5 hash:
c78bab123cd035153467cd4b31b8ece8
SHA1 hash:
9fcc84d21ce3ed6fd29f53fec5eb4e6c6c7b4649
Link:
https://www.unpac.me/results/428aaf1f-e2cc-4bca-ad97-03a44bc08f74/
SH256 hash:
51266e1c4f06e9a6fba8dc0a420fe359b9771c0645912827db24fa069e06cdb9
MD5 hash:
8345cbf2723bd9a0f6fc847a119cee96
SHA1 hash:
e28bedff7bc1af613d1a8ce3fdf2ea50703d8568
Link:
https://www.unpac.me/results/428aaf1f-e2cc-4bca-ad97-03a44bc08f74/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/428aaf1f-e2cc-4bca-ad97-03a44bc08f74/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.OfferCore

Executable exe 4a2f27cd964a95d5247269e51ec2f3c956f3fecc588459f4c111fa0b598b8a0b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95808/

Comments