MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57
SHA3-384 hash:	d321541925d68083b41e09d8996a7e98fd61b09552ea686e97a632f0f742c6d7b11aa9d63acdf67daf7d679dab4358de
SHA1 hash:	7143f1b57d9a6e419e807580d6e5a13878a797ec
MD5 hash:	4076f1d7c690f02d41a386c24ef63a00
humanhash:	potato-romeo-triple-one
File name:	Oficio_5201042026.exe
Download:	download sample
File size:	84'950'424 bytes
First seen:	2026-04-08 06:28:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	88016fcdef7f227c62171d0afad9aae4 (7 x ValleyRAT, 6 x OffLoader, 3 x Gh0stRAT)
ssdeep	1572864:wW7mT8Psdhx+WQXmyAj+cCWgAv3M5J5ilWJ0bsbvmqEN4BkF1EZDOsLE:DmgsMPXmr+cCWBv3KCdb4p8sLE
TLSH	T12818333BE18A6579E06E2D363572E210943FBE5169030C1B96FCB04CDF356B11E3EA96
TrID	50.8% (.EXE) Inno Setup installer (107240/4/30) 20.4% (.EXE) InstallShield setup (43053/19/16) 19.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.0% (.EXE) Win64 Executable (generic) (6522/11/2) 2.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	5050d270cccc82ae (112 x Adware.Generic, 71 x OffLoader, 43 x LummaStealer)
Reporter	JAMESWT_WT
Tags:	exe oficiospolicia-com signed Stalin-Fabrico-Loor-Romero xx-kak-is

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

125

Origin country :

IT

Vendor Threat Intelligence

ACCE Inno_Setup SplitBlock_Packer

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3adacf2a-70a8-4912-a76a-7c5bae587e23/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Oficio_5201042026.exe

Verdict:

Malicious activity

Analysis date:

2026-04-08 06:29:53 UTC

Tags:

delphi inno installer nodejs

Link:

https://app.any.run/tasks/416537c8-6c6e-4937-8594-4a1a84066053

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d5f5e36a61012f6acff731

Tags:

vmdetect delphi

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Sending a custom TCP request

Creating a file in the %AppData% directory

DNS request

Connection attempt

Unauthorized injection to a recently created process

Loading a suspicious library

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.io

Gathering data

Hybrid Analysis Generik_EIXOMQY_trojan

Verdict:

Malicious

Labled as:

Generik_EIXOMQY_trojan

Link:

https://www.hybrid-analysis.com/sample/555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-04-08T04:31:00Z UTC

Last seen:

2026-04-08T04:52:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan.Script.Agent.gen

Link:

https://opentip.kaspersky.com/555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57/results?tab=lookup

Nucleon Malprob Susipicious

Score:

53%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57

CERT.PL MWDB

Gathering data

Neiki Trojan.Script.Agent

Verdict:

Malicious

Threat:

Trojan.Script.Agent

Link:

https://tip.neiki.dev/file/555f42c53dfd9c633f242ef3baca797365c2daee9af2475db2171d6fc2cd2b57

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-03 22:00:17 UTC

File Type:

PE (Exe)

AV detection:

15 of 37 (40.54%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kvpufrj57woggpzef3z3vstzons4fwxotlzeoxnsc4ow7qwnfnlq._file

Threatray shellcode_loader_008

Verdict:

malicious

Label(s):

shellcode_loader_008

Alert

Create hunting rule

Similar samples:

error

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery installer persistence revoked_codesign

Link:

https://tria.ge/reports/260408-g88ztscv8x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Adds Run key to start application

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.