MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815
SHA3-384 hash:	79c10a060f31aac392870fc6158902f20f2af474c225e55180d5d2420c45a1afa345e67e764b19a28a69d465c4f01cb0
SHA1 hash:	d58953fab52eba0d293c5190cfdb2ad9a3c1839d
MD5 hash:	be27e7f9638ffdb00fea6153fb7e5c87
humanhash:	purple-delta-glucose-sierra
File name:	PSCom52.dll
Download:	download sample
File size:	20'480 bytes
First seen:	2026-09-12 16:57:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
ssdeep	384:3Vv5FyKF6ueabNxumw65YRg5LHC+mYfwYo8KZfaxP:3VlHui1Lj1o3Y
TLSH	T1FC92080463FC812EE4BE0BB8BCF242219371FA125E13DB0E2B88459D5D77798DC51BA6
TrID	44.6% (.EXE) Win64 Executable (generic) (6522/11/2) 14.0% (.ICL) Windows Icons Library (generic) (2059/9) 13.8% (.EXE) OS/2 Executable (generic) (2029/13) 13.7% (.EXE) Generic Win/DOS Executable (2002/3) 13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	ffforward
Tags:	com-server dll Dotnet dropped-by-wailsloader exe netdll WailsLoader X64

ffforward

Stage 4 managed .NET assembly (netdll) dropped by AdPayWorks WailsLoader. Implements IPSCom COM interface; invoked by LOLBin Register-CimProvider via api.exe.

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-12 17:08:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c6cdc30e-2a75-46fa-89bf-7982ce11b0ec

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/85194/

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

dllhost lolbin masquerade

Link:

https://www.filescan.io/uploads/6aa584b256972c9d7c5e15ae/reports/71f15fcb-2828-4e91-98d7-67f0149bc974/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/c12de2da-0e31-4ab8-8894-8ef0be067ae6

Score:

36%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.23 Win 64 Exe x64

Link:

https://app.malva.re/file/be27e7f9638ffdb00fea6153fb7e5c87

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kk3qkqgfxoipumo3bnhwrp7vx3gt4vvelym25pd4uggne2ubxakq._file

Gathering data

Unpacked files

SH256 hash:

52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815

MD5 hash:

be27e7f9638ffdb00fea6153fb7e5c87

SHA1 hash:

d58953fab52eba0d293c5190cfdb2ad9a3c1839d

Link:

https://www.unpac.me/results/378da1b6-c77d-4cf5-97da-f89fd299d340/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/52b70540c5bb90fa31db0b4f68bff5becd3e56a45e19aebc7ca18cd26a81b815

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.