MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59ceb7b47ebb9ed5189afe1afe79a80c854bb2ddec62a23ec2c380465a9598a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	59ceb7b47ebb9ed5189afe1afe79a80c854bb2ddec62a23ec2c380465a9598a8
SHA3-384 hash:	487855bdb8afdc903177cd89a4181a4d8d88371f6f8222ed5364e1e1340b893d4d98c2741234cffa94903935d85176bf
SHA1 hash:	48be6c930abe4d2ca2e48062ebde40acbf166c77
MD5 hash:	74ddfab4a0c0d19c1812c5b2f8a63e1f
humanhash:	bravo-finch-princess-east
File name:	Package_Damage_Documentation_MP4.zip
Download:	download sample
File size:	139'327'493 bytes
First seen:	2026-10-14 04:36:20 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	3145728:Ohv6ChSfBukwWBJm9Bbp30hWU+vDk/YSwbRcfwl2:1Cgu1WUB13rIQ152
TLSH	T11768330D0EBA4486F577A0B37473201F4E6DAB8A25B46AE9F55D385C0562EF50B0BE0F
Magika	zip
Reporter	koluke
Tags:	zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

323

Origin country :

JP

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad136cdf4e17c78f715f2fb

Tags:

injection dropper expiro virus

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/59ceb7b47ebb9ed5189afe1afe79a80c854bb2ddec62a23ec2c380465a9598a8

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

Link:

https://opentip.kaspersky.com/59ceb7b47ebb9ed5189afe1afe79a80c854bb2ddec62a23ec2c380465a9598a8/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/59ceb7b47ebb9ed5189afe1afe79a80c854bb2ddec62a23ec2c380465a9598a8

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-14 04:37:57 UTC

File Type:

Binary (Archive)

Extracted files:

10389

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lhhlpnd6xopnkge27ynp46nibscuxmw55rrkepwcyoaemwuvtcua._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

adware discovery execution persistence spyware stealer

Link:

https://tria.ge/reports/261014-f5lvfswx2j/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Browser Information Discovery

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Reads user/profile data of web browsers

System Location Discovery: System Language Discovery

System Time Discovery

Drops file in Windows directory

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Adds Run key to start application

Registers new Windows logon scripts automatically executed at logon.

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.