🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


PureHVNC


Vendor detections: 16


Intelligence 16 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
SHA3-384 hash: 6564b2269cc48296bf24c2f528a5af452f995c8417655e969c4571f6f9e4257899bb215395b4414402b024a2591e5621
SHA1 hash: 17ab1efb12a913d1df62764544e2bf185127fb09
MD5 hash: 9fab8e01c3e06e09e10b7ccbf1935500
humanhash: angel-muppet-uncle-arkansas
File name:889404755281_signed.pdf.exe
Download: download sample
Signature PureHVNC
Create hunting rule
File size:1'313'280 bytes
First seen:2026-05-18 11:09:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'243 x AgentTesla, 20'499 x Formbook, 12'374 x SnakeKeylogger)
ssdeep 24576:LdKXPGcNoSbf23Q4qKb57JInmjWWH2Ow33V44k7P0cFEGEYitehLC0eI3Wewm:M/lSRNenmjvH2OG3VBupviV09Sm
Threatray 28 similar samples on MalwareBazaar
TLSH T1815523B0ABD8E012C66A47B62C70E3304B368D69DA21D387CEFDBCF7791D6116925253
TrID 73.9% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.6% (.EXE) Win64 Executable (generic) (6522/11/2)
4.5% (.EXE) Win32 Executable (generic) (4504/4/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
dhash icon 2060e16cdcce8e06 (9 x Formbook, 1 x PureHVNC, 1 x RemcosRAT)
Reporter abuse_ch
Tags:exe PureHVNC

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/371b47e3-9bfe-4c29-87df-7d3ce281e2df/
Malware family:
n/a
ID:
1
File name:
_648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587.exe
Verdict:
Malicious activity
Analysis date:
2026-05-18 11:20:45 UTC
Tags:
stealer purecrypter purelogs auto-startup
Link:
https://app.any.run/tasks/766d85f6-4087-47c6-88ba-b8547dfaa9c0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/66275/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a0af3b64841ff6ff7ac2e89
Tags:
underscore autorun
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a service
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
Сreating synchronization primitives
Connection attempt
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Reading critical registry keys
Stealing user critical data
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade packed vbnet
Link:
https://www.filescan.io/uploads/6a0af3af875badc3b38a07dd/reports/6d720f6a-d8ed-4c3a-a4e4-e50628113b51/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-05-17T23:48:00Z UTC
Last seen:
2026-05-20T05:10:00Z UTC
Hits:
~100
Detections:
Trojan-PSW.Stealer.HTTP.C&C Trojan-Dropper.Scrop.HTTP.C&C PDM:Trojan.Win32.Generic PDM:Trojan.Win32.Badex.d HEUR:Trojan.MSIL.Injuke.gen
Link:
https://opentip.kaspersky.com/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/6cd5b484-0f7c-4666-96e6-262743f3ac40
Result
Threat name:
n/a
Detection:
malicious
Classification:
spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1914930
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Creates a thread in another existing process (thread injection)
Found many strings related to Crypto-Wallets (likely being stolen)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Suricata IDS alerts for network traffic
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected MSIL Injector
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1914930 Sample: 889404755281_signed.pdf.exe Startdate: 18/05/2026 Architecture: WINDOWS Score: 100 57 Suricata IDS alerts for network traffic 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 Yara detected MSIL Injector 2->61 63 7 other signatures 2->63 8 889404755281_signed.pdf.exe 2 2->8         started        11 889404755281_signed.pdf.exe 2 2->11         started        process3 signatures4 65 Switches to a custom stack to bypass stack traces 8->65 67 Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent) 8->67 13 889404755281_signed.pdf.exe 15 5 8->13         started        17 889404755281_signed.pdf.exe 3 11->17         started        process5 dnsIp6 55 64.89.160.73, 443, 49693, 49694 DIXIE-NETUS United States 13->55 69 Tries to steal Mail credentials (via file / registry access) 13->69 71 Found many strings related to Crypto-Wallets (likely being stolen) 13->71 73 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 13->73 75 Tries to harvest and steal browser information (history, passwords, etc) 13->75 19 chrome.exe 3 13->19         started        22 chrome.exe 2 13->22 injected 24 chrome.exe 2 13->24 injected 32 2 other processes 13->32 77 Writes to foreign memory regions 17->77 79 Creates a thread in another existing process (thread injection) 17->79 81 Injects a PE file into a foreign processes 17->81 26 chrome.exe 17->26         started        28 chrome.exe 17->28 injected 30 chrome.exe 17->30 injected 34 3 other processes 17->34 signatures7 process8 dnsIp9 41 192.168.2.12, 138, 443, 49683 unknown unknown 19->41 36 chrome.exe 2 19->36         started        39 chrome.exe 26->39         started        process10 dnsIp11 43 googlehosted.l.googleusercontent.com 142.250.217.129, 443, 49713 GOOGLEUS United States 36->43 45 www.google.com 142.251.150.119, 443, 49702, 49708 GOOGLEUS United States 36->45 51 3 other IPs or domains 36->51 47 142.250.68.193, 443, 49735 GOOGLEUS United States 39->47 49 142.251.155.119, 443, 49729, 49730 GOOGLEUS United States 39->49 53 3 other IPs or domains 39->53
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.27 Win 32 Exe x86
Link:
https://app.malva.re/file/9fab8e01c3e06e09e10b7ccbf1935500
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587/
Verdict:
Malicious
Threat:
Family.PURECRYPTER
Link:
https://tip.neiki.dev/file/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
Threat name:
ByteCode-MSIL.Trojan.DarkCloud
Create hunting rule
Status:
Malicious
First seen:
2026-05-18 11:10:45 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=msg72eh7k3qeqwgut662onxoiqptvr6xsog5wfpmpkkft7amewdq._file
Verdict:
malicious
Label(s):
purecrypter
Create hunting rule
Similar samples:
4e9316a576cdd68222c70179622ccd13dcdc90f331459249a2d3b6b158c889d2
PureHVNC
57f4cdc0363e85d6542a2473eb252711dfc1667d6a2875d2c507fc817bced680
PureHVNC
648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
PureHVNC
9b6b53ffc24cf8ca9350321c1b073a7ff034eca45020453af607be0d455d47dd
PureHVNC
9d34b9747ceb4a2a40f23df7e3f91fa3a96cac6f1931cdb2081ca5b84a81c6cc
PureHVNC
d7e987c4a9d74af9ccdc5405cecdea301b0a764e1a5cae1dbf4a4f76104edd14
PureHVNC
dbcf961fa63cec5fc675bd20be2b3ebe3a71d2fcd11a4e0aacb1e991de9c184f
PureHVNC
error
PureHVNC
+ 18 additional samples on MalwareBazaar
Gathering data
Unpacked files
SH256 hash:
648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587
MD5 hash:
9fab8e01c3e06e09e10b7ccbf1935500
SHA1 hash:
17ab1efb12a913d1df62764544e2bf185127fb09
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
a8e9af5d5db01b452944e83f445f25e3d3d04275127f12f8c368053b23c58694
MD5 hash:
a9e32f0739d267f3ba035595a0a1558c
SHA1 hash:
13db8d9b4a34689ef263de6734dc38bb58f7f795
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
cf5ea7ef6f61feeb3558a467b072d79d6818c342462e34d1feb8e29fc36ae825
MD5 hash:
fae5581984e345bbeaa8f62a0f66df82
SHA1 hash:
402f0403ee54f02549175f4360513439ebee3419
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
88bde506047bc5de8de4f94bbfe4cd0d208814f200948532e98a3d8d1e40c7bf
MD5 hash:
e1c3bb4aad886ef2a3558e110f4c5d17
SHA1 hash:
cae8845af53f63543ded6863269221b59c344aae
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
8414a6e8fe77695ed28446ac4d8100427596d0f2ddafeeee09e54cc2b3333bc7
MD5 hash:
d80074243771cf3cd29ec2b546d0255e
SHA1 hash:
58255d1b861c8d8f70c57ea41c4a08081099431c
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
07be376884a44a67dfb18bf89232abbefce64e82a369426e7bf3cf6b92e99d2b
MD5 hash:
e895770df4c24282a8d25295e189159a
SHA1 hash:
64cb2abbf048900bbcc6a3a570092b448a85af37
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
SH256 hash:
b2a66e9864f81c2800a5afef4bfd1faf7c910e5a43ea2eb9dbb15c8ab6ffc633
MD5 hash:
f0a13fb422cdb1f3ce667df897b5045b
SHA1 hash:
9b6566603e3a292482788924a83a1d94a9cd4627
Link:
https://www.unpac.me/results/9b8c62f2-9009-44aa-b0e3-73c4fe53244d/
Malware family:
PureRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/648dfd10ff56/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/648dfd10ff56e04858d49fbda736ee441f3ac7d7938ddb15ec7a9459fc0c2587

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/66275/

Comments