🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.OfferCore


Vendor detections: 15


Intelligence 15 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6
SHA3-384 hash: c045fb4020021347761ae220c53a2186faf3dd9c8223be27b66b2d86e7c05cdd34efa5a43fba9cdc7d8f21e7ac3ae81a
SHA1 hash: d6268660c1bfa72b04c4b9f1f5faa24ce229aefb
MD5 hash: ba18c85aa0fbce9eabff8d46bbce5241
humanhash: bulldog-wisconsin-lima-lemon
File name:856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6.exe
Download: download sample
Signature Adware.OfferCore
Create hunting rule
File size:2'132'376 bytes
First seen:2026-10-31 00:21:10 UTC
Last seen:2026-10-31 01:20:14 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (32 x ValleyRAT, 30 x Adware.OfferCore, 23 x Tofsee)
ssdeep 24576:TXNrSLScusMmOvjjhzvLt71KBTdgkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXcQ:QuI2h4TdHcTeynRkfg7ve+AhrWzOUe
TLSH T129A5D03FB28B653EE06E5A3A7A72E210583B7A6165138C5696F4C84CCF254701E3F787
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon b36494a8cca2cc4d (19 x Adware.OfferCore, 6 x RedLineStealer, 1 x RaccoonStealer)
Reporter Tuxxin
Tags:Adware.OfferCore exe signed

Code Signing Certificate

Organisation:SOFTONIC INTERNATIONAL SA
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-28T00:00:00Z
Valid to:2027-01-28T23:59:59Z
Serial number: c3607b2510e7ab39ff16c1998bbf0c85
Intelligence: 17 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b1e1dbb1624601638e698d1bf0c4e080eb335e6fb4dd29df68ab6951a96452e7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
206
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/665feef0-8ce1-47c5-a38b-e8fcd2a616fd/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-31 00:42:04 UTC
Tags:
installer offercore adware innosetup delphi inno
Link:
https://app.any.run/tasks/f2a45649-166a-450e-9aa2-868b37e861d1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96271/
Detection(s):
SecuriteInfo.com.Adware.Downware.20879.23872.21015.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae53480b121dd519dcef271
Tags:
shellcode injection dropper delphi
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader embarcadero_delphi inno installer installer obfuscated signed
Link:
https://www.filescan.io/uploads/6ae5347dfba89c87525eee10/reports/8dea976c-ba8e-48dd-911e-dfa72bab187b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6
Verdict:
Adware
File Type:
exe x32
First seen:
2026-11-01T19:34:00Z UTC
Last seen:
2026-11-01T19:38:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9e5c8936-b1c5-46ae-b795-1730d6367259
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad.troj
Score:
32 / 100
Link:
https://www.joesandbox.com/analysis/1995638
Signature
Contains functionality to infect the boot sector
Detected potential unwanted application
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995638 Sample: qRdbVkfcvr.exe Startdate: 31/10/2026 Architecture: WINDOWS Score: 32 74 swls.map.fastly.net 2->74 76 images.sftcdn.net 2->76 78 2 other IPs or domains 2->78 98 Multi AV Scanner detection for submitted file 2->98 100 Detected potential unwanted application 2->100 102 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->102 11 qRdbVkfcvr.exe 2 2->11         started        signatures3 process4 file5 52 C:\Users\user\AppData\...\qRdbVkfcvr.tmp, PE32 11->52 dropped 14 qRdbVkfcvr.tmp 5 24 11->14         started        process6 dnsIp7 84 swls.map.fastly.net 151.101.1.91, 443, 49709 FASTLY-FastlyIncUS Canada 14->84 86 151.101.65.91, 443, 49711 FASTLY-FastlyIncUS Canada 14->86 88 2 other IPs or domains 14->88 68 C:\Users\user\AppData\...\is-K9RT02ADYW.tmp, PE32 14->68 dropped 70 bizagi-studio-11.2...nstaller.exe (copy), PE32 14->70 dropped 72 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 14->72 dropped 96 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 14->96 19 cookie_mmm_irs_ppi_008_585.exe 6 40 14->19         started        24 OperaGXSetup.exe 2 14->24         started        26 bizagi-studio-11.2.50811-installer.exe 14->26         started        file8 signatures9 process10 dnsIp11 80 100.58.11.116 AMAZON-AES-AmazoncomIncUS United States 19->80 82 23.39.228.205 AKAMAI-ASN1NL United States 19->82 42 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 19->42 dropped 44 C:\Windows\Temp\...\icarus_mod.dll, PE32 19->44 dropped 46 C:\Windows\Temp\...\icarus.exe, PE32+ 19->46 dropped 50 2 other files (none is malicious) 19->50 dropped 104 Contains functionality to infect the boot sector 19->104 28 icarus.exe 3 6 19->28         started        48 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 24->48 dropped 31 installer.exe 53 24->31         started        file12 signatures13 process14 dnsIp15 54 C:\Windows\Temp\...\icarus_ui.exe, PE32+ 28->54 dropped 56 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 28->56 dropped 58 C:\Windows\Temp\...\icarus_product.dll, PE32+ 28->58 dropped 66 8 other files (none is malicious) 28->66 dropped 90 107.167.110.216 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 31->90 92 107.167.125.189 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 31->92 94 4 other IPs or domains 31->94 60 C:\Users\user\AppData\Local\...\opera_package, PE32 31->60 dropped 62 C:\Users\user\...\additional_file1.tmp, PE32 31->62 dropped 64 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 31->64 dropped 34 installer.exe 1 5 31->34         started        36 installer.exe 4 31->36         started        38 installer.exe 31->38         started        file16 process17 process18 40 installer.exe 3 34->40         started       
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ba18c85aa0fbce9eabff8d46bbce5241
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6/
Threat name:
Win32.PUA.OfferCore
Create hunting rule
Status:
Suspicious
First seen:
2026-10-30 16:20:43 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
15 of 38 (39.47%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvxxcszknjt6z2ij3cmeacmasgmnzw4voomunx3bpwx7yoxwkkta._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery installer
Link:
https://tria.ge/reports/261031-angarahv8k/
Behaviour
Checks processor information in registry
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks for any installed AV software in registry
Checks installed software on the system
Executes dropped EXE
Downloads MZ/PE file
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
win_token
Link:
https://app.threat.zone/submission/fd14d261-1643-4e69-b73d-b157fc30268c
Malware Family:
offercore
Create hunting rule
Malicious:
True
Tags:
signed overlay
Link:
https://intel.virussign.com/intelligence/file/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6
Unpacked files
SH256 hash:
856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6
MD5 hash:
ba18c85aa0fbce9eabff8d46bbce5241
SHA1 hash:
d6268660c1bfa72b04c4b9f1f5faa24ce229aefb
Link:
https://www.unpac.me/results/461a44c7-63db-4c5e-8b60-64934c986f29/
SH256 hash:
657b164e6e5445cca5201c02b5a918276be39a46561e76d1ea0d914c5c546270
MD5 hash:
2cdc376676292d1be188a38c3c178ce5
SHA1 hash:
640069a6aeac23569ffe72cdcde0019e5f6445f5
Link:
https://www.unpac.me/results/461a44c7-63db-4c5e-8b60-64934c986f29/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/461a44c7-63db-4c5e-8b60-64934c986f29/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/856f714b2a6a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.OfferCore

Executable exe 856f714b2a6a67ece909d8984009809198dcdb95739946df617daffc3af652a6

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/96271/

Comments