🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.OfferCore


Vendor detections: 12


Intelligence 12 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd
SHA3-384 hash: 2c535781e255a5e911aba5a96a6918bf421119d0233c39c2a8776dd8b6147986deec3f4facd4844c09b3a42df2144310
SHA1 hash: 3c0c3b44797dfb711c9d69d7bde6de96cb49648e
MD5 hash: ad8073ffd7921c5371924268f11579be
humanhash: west-fish-jig-kilo
File name:4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd.exe
Download: download sample
Signature Adware.OfferCore
Create hunting rule
File size:2'134'200 bytes
First seen:2026-11-08 01:07:17 UTC
Last seen:2026-11-08 01:28:15 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (32 x ValleyRAT, 27 x Adware.OfferCore, 22 x Tofsee)
ssdeep 49152:suI2hGV/uZ/+QoV3E/+EGxbDaEzBAnVhRg:s5O8Q5o2/dGxbfzBAnVhRg
TLSH T1D7A5D03FB28B653EE06E5A367AB2E210583B7A6165134C5696F4C88CCF250701E3F797
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon b36494a8cca2cc4d (16 x Adware.OfferCore, 6 x RedLineStealer, 1 x RaccoonStealer)
Reporter Tuxxin
Tags:Adware.OfferCore exe signed

Code Signing Certificate

Organisation:SOFTONIC INTERNATIONAL SA
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-28T00:00:00Z
Valid to:2027-01-28T23:59:59Z
Serial number: c3607b2510e7ab39ff16c1998bbf0c85
Intelligence: 14 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b1e1dbb1624601638e698d1bf0c4e080eb335e6fb4dd29df68ab6951a96452e7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/97a5b633-9ab4-4ccd-ad57-39ccd32afd51/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-08 01:47:31 UTC
Tags:
installer offercore adware innosetup inno delphi
Link:
https://app.any.run/tasks/22cac7c7-7fff-4f08-981a-e84865ee4d1a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97925/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Creating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
Unknown
Threat level:
  10/10
Confidence:
100%
Tags:
embarcadero_delphi inno installer installer obfuscated signed
Link:
https://www.filescan.io/uploads/6aefcbb7862916f1ae143c5a/reports/7791ac75-6262-4600-8a97-88654e5460d8/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d6f1aa17-e21f-4b58-bed8-0ac3a08563ec
Result
Threat name:
n/a
Detection:
suspicious
Classification:
rans.evad
Score:
32 / 100
Link:
https://www.joesandbox.com/analysis/2000555
Signature
Contains functionality to infect the boot sector
Detected potential unwanted application
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000555 Sample: uBVnqdGdP5.exe Startdate: 08/11/2026 Architecture: WINDOWS Score: 32 168 swls.map.fastly.net 2->168 170 images.sftcdn.net 2->170 172 2 other IPs or domains 2->172 198 Multi AV Scanner detection for submitted file 2->198 200 Detected potential unwanted application 2->200 11 uBVnqdGdP5.exe 2 2->11         started        14 svchost.exe 2->14         started        16 svchost.exe 2->16         started        18 7 other processes 2->18 signatures3 process4 dnsIp5 124 C:\Users\user\AppData\...\uBVnqdGdP5.tmp, PE32 11->124 dropped 21 uBVnqdGdP5.tmp 5 24 11->21         started        26 MpCmdRun.exe 14->26         started        28 WerFault.exe 16->28         started        30 WerFault.exe 16->30         started        174 127.0.0.1 unknown unknown 18->174 32 msiexec.exe 18->32         started        file6 process7 dnsIp8 186 swls.map.fastly.net 151.101.1.91, 443, 49708, 49717 FASTLY-FastlyIncUS Canada 21->186 188 d2it9arwsniqaq.cloudfront.net 99.84.169.140, 443, 49704, 49705 AMAZON-02-AmazoncomIncUS United States 21->188 114 C:\...\activeinspire-3.5.18-installer.exe, PE32 21->114 dropped 116 C:\...\avast_free_antivirus_setup_online.exe, PE32 21->116 dropped 118 activeinspire-3.5....nstaller.exe (copy), PE32 21->118 dropped 122 5 other files (2 malicious) 21->122 dropped 208 Writes many files with high entropy 21->208 210 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 21->210 34 avast_free_antivirus_setup_online.exe 1 2 21->34         started        39 OperaSetup.exe 2 21->39         started        41 activeinspire-3.5.18-installer.exe 21->41         started        47 2 other processes 21->47 43 conhost.exe 26->43         started        45 Conhost.exe 26->45         started        120 C:\Users\user\AppData\Local\Temp\...\7za.exe, PE32 32->120 dropped file9 signatures10 process11 dnsIp12 176 142.250.190.238 GOOGLE-GoogleLLCUS United States 34->176 178 142.250.65.78 GOOGLE-GoogleLLCUS United States 34->178 182 3 other IPs or domains 34->182 108 C:\...\avast_free_antivirus_online_setup.exe, PE32 34->108 dropped 204 Contains functionality to infect the boot sector 34->204 49 avast_free_antivirus_online_setup.exe 34->49         started        110 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 39->110 dropped 54 installer.exe 82 39->54         started        112 C:\...\activeinspire-3.5.18-installer.exe, PE32 41->112 dropped 206 Writes many files with high entropy 41->206 56 activeinspire-3.5.18-installer.exe 41->56         started        180 135.234.160.245 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 47->180 file13 signatures14 process15 dnsIp16 160 52.72.139.238 AMAZON-AES-AmazoncomIncUS United States 49->160 90 C:\Windows\Temp\...\icarus.exe, PE32+ 49->90 dropped 92 C:\Windows\Temp\...\setupui.cont, XZ 49->92 dropped 94 C:\...\cd5b6dc2-df44-4a4b-aa87-d16874900e7b, LZMA 49->94 dropped 102 9 other files (5 malicious) 49->102 dropped 202 Writes many files with high entropy 49->202 58 icarus.exe 49->58         started        162 107.167.110.216 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 54->162 164 107.167.125.189 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 54->164 166 7 other IPs or domains 54->166 96 C:\Users\user\AppData\Local\...\opera_package, PE32 54->96 dropped 98 de932af914ba00303d...831101e2.crx (copy), Google 54->98 dropped 104 4 other files (1 malicious) 54->104 dropped 63 installer.exe 54->63         started        65 Assistant_136.0.6008.52_Setup.exe_sfx.exe 54->65         started        67 assistant_installer.exe 54->67         started        75 2 other processes 54->75 100 C:\Users\user\...\ActivInspireSuite.msi, Composite 56->100 dropped 106 18 other files (none is malicious) 56->106 dropped 69 ISBEW64.exe 56->69         started        71 ISBEW64.exe 56->71         started        73 ISBEW64.exe 56->73         started        77 2 other processes 56->77 file17 signatures18 process19 dnsIp20 190 8.8.8.8 GOOGLE-GoogleLLCUS United States 58->190 192 34.160.176.28 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 58->192 194 3 other IPs or domains 58->194 126 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 58->126 dropped 128 C:\Windows\Temp\...\icarus_product.dll, PE32+ 58->128 dropped 130 C:\Windows\Temp\...\icarus.exe, PE32+ 58->130 dropped 138 13 other files (8 malicious) 58->138 dropped 212 Writes many files with high entropy 58->212 79 icarus.exe 58->79         started        83 icarus.exe 58->83         started        132 C:\Users\user\AppData\...\wave-light.zip, Zip 63->132 dropped 134 C:\Users\user\AppData\Local\...\wave-dark.zip, Zip 63->134 dropped 136 C:\Users\user\AppData\...\opera-one-light.zip, Zip 63->136 dropped 140 29 other files (11 malicious) 63->140 dropped 86 installer.exe 63->86         started        142 4 other files (none is malicious) 65->142 dropped 88 assistant_installer.exe 67->88         started        file21 signatures22 process23 dnsIp24 144 C:\...\snxhk.dll.ipending.315b0fc9, PE32 79->144 dropped 146 C:\...\dnd_helper.dll.ipending.315b0fc9, PE32 79->146 dropped 148 C:\...\sched.exe.ipending.315b0fc9, PE32+ 79->148 dropped 156 338 other files (218 malicious) 79->156 dropped 196 Writes many files with high entropy 79->196 184 23.199.62.81 AKAMAI-ASN1NL United States 83->184 150 C:\...\uiext.dll.ipending.ae3f973c, PE32+ 83->150 dropped 152 C:\...\swhealthex2.dll.ipending.ae3f973c, PE32+ 83->152 dropped 154 C:\...\protobuf.dll.ipending.ae3f973c, PE32+ 83->154 dropped 158 170 other files (135 malicious) 83->158 dropped file25 signatures26
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ad8073ffd7921c5371924268f11579be
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd/
Threat name:
Win32.PUA.OfferCore
Create hunting rule
Status:
Suspicious
First seen:
2026-11-07 20:13:56 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
12 of 36 (33.33%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jowr2tttoa6xtd37imftqdibzjo4vot5syboks7qtk3w37u7lx6q._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery installer
Link:
https://tria.ge/reports/261108-bhgj1awyg1/
Behaviour
Checks processor information in registry
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks for any installed AV software in registry
Checks installed software on the system
Executes dropped EXE
Downloads MZ/PE file
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
win_token
Link:
https://app.threat.zone/submission/13070ba5-491d-457d-b753-fe17e3d92964
Malware Family:
offercore
Create hunting rule
Malicious:
True
Tags:
signed overlay
Source:
https://www.virussign.com/
Unpacked files
SH256 hash:
4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd
MD5 hash:
ad8073ffd7921c5371924268f11579be
SHA1 hash:
3c0c3b44797dfb711c9d69d7bde6de96cb49648e
Link:
https://www.unpac.me/results/f2e1935c-4add-4299-b5e9-dd87f7f95155/
SH256 hash:
417ee34f1cfed90c99e5fbc44c8e52e32cde1bb1dcd28d07fda3cbf1300303cc
MD5 hash:
7cdcc851b51ac1fc2ce3a015eeab2208
SHA1 hash:
9e4be692dd3ca98d0972e255c0f52d0936f8925c
Link:
https://www.unpac.me/results/f2e1935c-4add-4299-b5e9-dd87f7f95155/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/f2e1935c-4add-4299-b5e9-dd87f7f95155/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.OfferCore

Executable exe 4bad1d4e73703d798f7f430b380d01ca5dcaba7d9602e54bf09ab76dfe9f5dfd

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/97925/

Comments