🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239
SHA3-384 hash: 5a903091dbb877b86acafcafa64e4ff9167a92c1509f5a472de02841b9c66e6e689bb38c8ad86c57b34ba1ef06ab786d
SHA1 hash: 1f6a5fe73c7ce9c0d760e74c3a77997316afe4d0
MD5 hash: 32843397fa0846ae0628a4ad74b28df7
humanhash: asparagus-stairway-december-eleven
File name:45.141.27.27_wdplc.dll
Download: download sample
File size:24'064 bytes
First seen:2026-10-10 12:09:04 UTC
Last seen:Never
File type:DLL dll
MIME type:application/vnd.microsoft.portable-executable
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep 384:Tr+zsmA4pG135JlvSoo0NA0tnUyDlgyhD2/333YS72XJFSNpQZHUMC5XdWOdALSE:Asm4JlxA0tnUyDl7Q333YS7AFHHOQhk2
TLSH T111B2299C63EDCB6AC17E0B7E497242100374B9679E53F38E4EF8C66C18327D059456BA
TrID 25.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
25.3% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win32 Executable (generic) (4504/4/1)
8.0% (.ICL) Windows Icons Library (generic) (2059/9)
7.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter Darkfibr

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91356/
Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad0ad936f551121ba15f21b
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239
Verdict:
Unknown
File Type:
executable.pe.32.dll
Link:
https://opentip.kaspersky.com/5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c59c9b4f-37e4-4f48-beb6-f16ca7b0828b
Score:
39%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.32 Win 32 Exe x86
Link:
https://app.malva.re/file/32843397fa0846ae0628a4ad74b28df7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=limkfnm6iqaylhfp5745g5gjtc4bzvlp6bx3ydnue6imstnrgi4q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/261010-qajrqavxbt/
Unpacked files
SH256 hash:
5a18a2b59e4401859cafeff9d374c998b81cd56ff06fbc0db42790c94db13239
MD5 hash:
32843397fa0846ae0628a4ad74b28df7
SHA1 hash:
1f6a5fe73c7ce9c0d760e74c3a77997316afe4d0
Link:
https://www.unpac.me/results/be73c15c-f63e-49f9-83d8-5949deffd3af/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/91356/

Comments