MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60
SHA3-384 hash: 878f478be12ef0c09f9791758a33f962381678307011631ff063df5afdf1e327f3873133a00d0d5537c9aef7c71d7d99
SHA1 hash: 42e0ab37c0db1d941098802edb0952ac7434dc6c
MD5 hash: 796fd4e9d7da619b8330d902e9f3b7ec
humanhash: mobile-pizza-whiskey-oscar
File name:file
Download: download sample
File size:3'249'544 bytes
First seen:2026-06-10 13:11:47 UTC
Last seen:2026-06-12 00:43:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 31d397f35586b7be22be72ee489bb6b8
ssdeep 49152:OtjSh2Wy3BVkTcnScAgtJ0bG3LDdarO75EUPPZKCb1jGeg8brLZ:Otjq230AJ0y3/wr0Px/HgGrt
TLSH T1DAE533CE5AF822B7F0A11BF4BDFCC993972DE76932C49193688386DD2851D74F48124A
TrID 38.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.6% (.ICL) Windows Icons Library (generic) (2059/9)
15.4% (.EXE) OS/2 Executable (generic) (2029/13)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 71cc8e96968ecc71
Reporter Bitsight
Tags:a dropped-by-gcleaner exe MIX6.file signed

Code Signing Certificate

Organisation:Battery Excel Export
Issuer:Battery Excel Export
Algorithm:sha512WithRSAEncryption
Valid from:2026-06-10T11:36:19Z
Valid to:2029-06-10T11:46:19Z
Serial number: 148abb03f5b455aa43ddb2033d5bc357
Thumbprint Algorithm:SHA256
Thumbprint: fc43b83739593932da3617fe3c26d6443fcf76965f58fcbfddd84d6009e2301c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
Bitsight
url: http://158.94.209.95/service

Intelligence

File Origin
# of uploads :
15
# of downloads :
158
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60.zip
Verdict:
No threats detected
Analysis date:
2026-06-10 13:16:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/30e91107-f4c4-44ff-a279-288b4e731cb1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70516/
Verdict:
Clean
Score:
82.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2962d534eaf30d8ce485a3
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Connection attempt
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed packed signed themidawinlicense
Link:
https://www.filescan.io/uploads/6a2962ccbf16337e43bfe6d0/reports/9bccfab0-e27e-4d24-84c9-45a4eb0dc96b/overview
Verdict:
Malicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60
Verdict:
Clean
File Type:
exe x64
First seen:
2026-06-10T11:56:00Z UTC
Last seen:
2026-06-11T23:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/09f1a4cc-6f6d-47f1-b627-57e189939bca
Score:
34%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o2ly7glbmvxbfht6u7vqkq3cha733r52falsugjar26a3vhi5nqa._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion themida trojan
Link:
https://tria.ge/reports/260610-qfzp5aay9t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Checks whether UAC is enabled
Checks BIOS information in registry
Themida packer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60
MD5 hash:
796fd4e9d7da619b8330d902e9f3b7ec
SHA1 hash:
42e0ab37c0db1d941098802edb0952ac7434dc6c
Link:
https://www.unpac.me/results/8234446f-8855-446f-9be2-2d83b62e5827/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 76978f9961656e129e7ea7eb054362383fbdc7ba28172a19208ebc0dd4e8eb60

(this sample)

  
Dropped by
Gcleaner
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/70516/

Comments