🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 31 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f
SHA3-384 hash: a033589259f53d205112b29eb0baacb313968ff5e513961c2454343d5dedc99b0132554df7835887d741a4a6f15467c2
SHA1 hash: 02c55d26d7719864096bd65bbb2092f4f799c6b7
MD5 hash: 9c89e2cded998fc929f11a6cbd8195ff
humanhash: double-pluto-kentucky-beer
File name:china4.zip
Download: download sample
File size:5'493'126 bytes
First seen:2026-10-20 09:17:53 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:FXf3Vji/9ope6muPmFLorbtmu6xK0uWbpoyFJ2Ko8QIsNuGbppkJhUi:FZiI1HmAb0u6gb0ZFRPspb8Ui
TLSH T11F46330BF050F8D9651D92FF2B5D58C7296BC61D9883D3D2CE4A3220EDA9F871862CE5
Magika zip
Reporter smica83
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
HU HU
File Archive Information

This file archive contains 7 file(s), sorted by their relevance:

File name:cximagecrtu.dll
File size:610'304 bytes
SHA256 hash: af5062786294b67d1befa07b6a43e4f22cec72a887fe2e94e937688e15c53cc3
MD5 hash: 42ff067bf20414c51d162959baded954
MIME type:application/x-dosexec
File name:EventLog.exe
File size:407'552 bytes
SHA256 hash: 6c204d3433fb2b029a3b3d908b7bfa9e44e14bd66b4bfdb42ba1690079b17f19
MD5 hash: 9738ef7eefb7f6361dd87e2ff1589220
MIME type:application/x-dosexec
File name:update.xml
File size:389'003 bytes
SHA256 hash: cba381dcd6b1ed6ddb494d35dc4f6be7dca832f040ef81cc4225e292c70e3dc1
MD5 hash: d2938907972f06ca8a77f629563156ab
MIME type:application/octet-stream
File name:mfc100u.dll
File size:4'368'720 bytes
SHA256 hash: 7a4cfbce1eb48d4f8988212c2e338d7781b9894ef0f525e871c22bb730a74f3e
MD5 hash: f841f32ad816dbf130f10d86fab99b1a
MIME type:application/x-dosexec
File name:msvcr100.dll
File size:770'384 bytes
SHA256 hash: 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
MD5 hash: 67ec459e42d3081dd8fd34356f7cafc1
MIME type:application/x-dosexec
File name:msvcp100.dll
File size:421'200 bytes
SHA256 hash: a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
MD5 hash: 03e9314004f504a14a61c3d364b62f66
MIME type:application/x-dosexec
File name:libmupdf.dll
File size:3'499'520 bytes
SHA256 hash: 55007f5e02c0be3515177478e9930981c94c59c89043708005c81f5aef84bae5
MD5 hash: a30312b7a63ce4fc454234f634ca21f9
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/3c99df78-5729-4e23-9fc1-7cda1059e18a/
Detection(s):
SecuriteInfo.com.FileRepMalware.21126887.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad3c643f4e17c78f7163e4e
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug evasive fingerprint microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6ad731d512b28d9f45ca24e8/reports/ebe31a96-9312-4a61-9979-bdd6464bd093/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f
Verdict:
Unknown
File Type:
zip
First seen:
2026-10-20T03:00:00Z UTC
Last seen:
2026-10-20T03:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/9c89e2cded998fc929f11a6cbd8195ff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qlw5mivf2aenhemlmy5bigs2uoyjigab2yp7k4l4nvjm6z533spq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/261020-n3myqsdt4p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: PowerShell
Drops file in Drivers directory
Sets service image path in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:JP_Lure_Content_Hunt
Create hunting rule
Author:sumeshi
Description:Hunts for files containing Japanese kana text or common Japanese lure terminology
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:MULTI_Malware_Unknown_ForgeAuto_9d9a5cf9
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:MULTI_Malware_Unknown_ForgeAuto_de8d8480
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (inconnu, etat binaire)
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_PythonStealer_ForgeAuto_b24cb5bd
Create hunting rule
Author:Marjoriefort
Description:Detects PythonStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Executable exe dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050

zip 82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f

(this sample)

  
Dropped by
SHA256 dc27bb3c16f98f11a2cdb88be7c4d3edf8348ce5b1a9334f5bd2e569f3cbf050
  
Dropped by
MD5 c9667ff75651fe9ec67263ca2c0bca8d

Comments