MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 12 File information Comments

SHA256 hash:	7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4
SHA3-384 hash:	4c8124a4aabb5b881385fd6709d86fae6cd44877f2e05f8f71ff12f14ba957b59198b82d4f137f8553feaf7a1e79a77f
SHA1 hash:	8dba416747784156fd4026340785f3be3bc42f61
MD5 hash:	9f18e13f1d73a045875d2c2a2d1ce338
humanhash:	one-sad-failed-ack
File name:	DTUMGTJE.zip
Download:	download sample
File size:	1'114'324 bytes
First seen:	2025-06-04 09:15:33 UTC
Last seen:	2025-06-04 09:38:06 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:mg4SwA9cIH/QyTT30ba8NFctke0QY0qjMTtkisCvrrfK9UZrV+dj/4emQgiee+4o:mwX1j8NVvjMTtTv7Mb4PQ924TIsCt
TLSH	T1363533E232A39B6852395627A1CFB70488FCF52D1B7951054E47F9CF2AB8BEC8336151
Magika	zip
Reporter	JAMESWT_WT
Tags:	clickcease-biz zip

Intelligence

File Origin

# of uploads :

# of downloads :

147

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68400f9c8bd5d68a12e4ffb6

Tags:

malware

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

adaptive-context explorer fingerprint keylogger lolbin microsoft_visual_cc

Link:

https://www.filescan.io/uploads/68400ec7171e01f959359c4d/reports/ef1b35f3-2c10-495e-bb81-0dae7a8938c9/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/250604-l5ghmavyf1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7938145ed340477b90f5856a354bf3b94998405895ecd8295389f61f62b104e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	elysium Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked elysium stealer malware samples.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)