MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5
SHA3-384 hash:	bd3e0e5b7fcf0b0efb2113f60a72644d63114304945ac4b5c703c3dc86a553ca846fe28be64797cc363ba7f9a0a84901
SHA1 hash:	dd88dbac58538178c6beac4be15112664e3db50d
MD5 hash:	784b133746547af60241c34f2baa4221
humanhash:	pip-seven-carbon-seven
File name:	shipping documents.exe
Download:	download sample
File size:	1'275'392 bytes
First seen:	2026-09-21 13:50:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'246 x AgentTesla, 20'507 x Formbook, 12'374 x SnakeKeylogger)
ssdeep	24576:fcL2MhgqlgQMFpl9xeA7hQzi5IO79L4qK:flMeqlg9Fpl9JQzmH9Li
TLSH	T19645E04113E89F58F8BFAB3C5478042047F6FC56AE35D7BE2E5858AD2872B80DA51723
TrID	73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.6% (.EXE) Win64 Executable (generic) (6522/11/2) 4.5% (.EXE) Win32 Executable (generic) (4504/4/1) 2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika	pebin
dhash icon	4db292f2d88cb40b (42 x DarkTortilla, 27 x AgentTesla, 15 x RemcosRAT)
Reporter	adrian__luca
Tags:	exe

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-21 14:08:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/556f081e-a212-4fd0-ba6f-71620ee2f1d8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/88004/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.3631.21009.13127.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

masquerade obfuscated obfuscated packed vbnet

Link:

https://www.filescan.io/uploads/6ab136579458c67b9819acbe/reports/0a3f5be8-6ea3-403b-8875-405308254fbf/overview

Verdict:

Malicious

Labled as:

Trojan.MSIL.Basic.8

Link:

https://www.hybrid-analysis.com/sample/634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-02T20:45:00Z UTC

Last seen:

2026-09-22T03:48:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/0d3375a0-a42f-4316-b6cc-e0b349dbbfae

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

Verdict:

inconclusive

YARA:

11 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.84 Win 32 Exe x86

Link:

https://app.malva.re/file/784b133746547af60241c34f2baa4221

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Suspicious

First seen:

2026-09-03 02:57:46 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

26 of 36 (72.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mnhossydwwiqpuuole6n6rvq2lldi7keiqfyuaizkikuyryhoxsq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery

Link:

https://tria.ge/reports/260921-q51cysbf72/

Behaviour

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

.NET Reactor proctector

Unpacked files

SH256 hash:

634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

MD5 hash:

784b133746547af60241c34f2baa4221

SHA1 hash:

dd88dbac58538178c6beac4be15112664e3db50d

Link:

https://www.unpac.me/results/2786ccb7-d741-4d35-9b84-d0d736869c24/

SH256 hash:

878a703f6ab32496cca3d0d719becf8db9693e56c685363fa65b9b8ac4110719

MD5 hash:

c62c019741d0cd010c75a914b13f141c

SHA1 hash:

bc9036f6befde31574fdb37c1e60e4852d2a85af

Detections:

INDICATOR_EXE_Packed_DotNetReactor

SUSP_OBF_NET_Reactor_Indicators_Jan24

Link:

https://www.unpac.me/results/2786ccb7-d741-4d35-9b84-d0d736869c24/

Parent samples :

fb0889110aec73085c455f345f4f920d68aec7ae70f84867c57c9ca0e49b9564
bbb3b4379bfe5ad9bc6776afeea7b583225f957e49d79b9c3610325c58697634
d2a4ad1db761a3776160317ba0325d100e65d2baea62d52effee899ab5d355a8
db25d1a378f932e8e6afd0ad46e0181a68310ab9e7a6e204ed7609e302082a39
9f2eca136750c9310914a50d810ee8102c513e628fa37b6795ac5fd653afbd36
0910fc3c5cb222b5b43eef9b187784e36e484728acaa1198b41fb54707c3e167
252f94e8ae17237b19cb38dd3b82e8c09f53c33a323d4a6a6ddd202dd4b59435
d8ef460c9a9914057ee4ccd122e74ca078a6b09e03f8b4a2f99a4139a78df29d
2423704f01108fc081ac5257cc60ed6ca266c3958c721cf091f98a6c103813df
080dfb9d893d2dd995e8fb81a4098a8d908c563e38d70a8e5bc15debcf1f065a
8a75a4f18fa244786f536da897be4e25300f27c1f9f28e31f6e09c941a0899d0
634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

exe 634ee94b03b59107d28e593cdf46b0d2d6347d44440b8a011952154c470775e5

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/88004/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample