🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b
SHA3-384 hash: 77157cb5b5fb33a018e36ff066079aa7e31b58a0d488ba0f0f6a37a9d10fd77f260c4e2147284cb10c0f325676d6ce63
SHA1 hash: 8773a14a80f23ec6ce9c5eae72480e7c18d8daf3
MD5 hash: 40f747b537eb469e2d106ec2e8bf4860
humanhash: triple-twelve-shade-kentucky
File name:Adobe Installer.iso
Download: download sample
File size:23'797'760 bytes
First seen:2026-10-24 20:34:07 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 393216:boJesJnkfBTky1b4UyhT/evPMRL31CPwDvt3uFhCkcFe9Xbp8kY3ucN6OyVBlH:2efBTky1DEBNuc8lr
TLSH T10D37BE16B2988199D467907CC853865BE3B2BC25AB6183DF30A6B32D1F337D12B7E354
TrID 88.2% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.GL) GRASP animation (6508/7/3)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
Magika iso
Reporter smica83
Tags:cyuop-com iso

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
HU HU
File Archive Information

This file archive contains 38 file(s), sorted by their relevance:

File name:_wmi.pyd
File size:40'304 bytes
SHA256 hash: a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
MD5 hash: c7427027acbd9a0076b598fc71ee45a5
MIME type:application/x-dosexec
File name:vcruntime140_1.dll
File size:49'776 bytes
SHA256 hash: 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 hash: c0c0b4c611561f94798b62eb43097722
MIME type:application/x-dosexec
File name:_socket.pyd
File size:85'496 bytes
SHA256 hash: 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
MD5 hash: 0106ee3f61a54d922190b3a01c81a453
MIME type:application/x-dosexec
File name:_asyncio.pyd
File size:74'096 bytes
SHA256 hash: c77de90cad749087a0c5dc5e19d78d24f6ef44e7e5ac19b8420cfc0cea62395d
MD5 hash: 0ad3abc085f1d954eff9dfa83039ebb7
MIME type:application/x-dosexec
File name:blind_engine.dat
File size:54'273 bytes
SHA256 hash: 9c10379a8a991560b3132084e23480624da505aecb11aa2058a8c2ffdaa471fd
MD5 hash: 8e4f1d46e2593c4d233c37d6eae21727
MIME type:application/octet-stream
File name:_ctypes.pyd
File size:127'480 bytes
SHA256 hash: 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
MD5 hash: 9314ab9707985aaf6e234b5c1fc3c3c6
MIME type:application/x-dosexec
File name:Adobe Installer.exe
File size:104'304 bytes
SHA256 hash: d72294fb338bc2fc8896d25a7395a4db466425427e1559e77185d5135a830681
MD5 hash: 72afbe203882951dc77a5cf6dcc07ffe
MIME type:application/x-dosexec
File name:_queue.pyd
File size:33'784 bytes
SHA256 hash: 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
MD5 hash: 6ffc75670dfed859cc7ca266bcc89816
MIME type:application/x-dosexec
File name:_uuid.pyd
File size:27'128 bytes
SHA256 hash: acce4f281d7ffb2dec0997527faf25b1df62ad7bd3032c568ddcf65c90edc867
MD5 hash: 3a531588286a202a51d21773533cdd2b
MIME type:application/x-dosexec
File name:_decimal.pyd
File size:262'000 bytes
SHA256 hash: aeacfead2befcc0768063a037bb64bd32109ae09cb144e5f571b04dd7965db9d
MD5 hash: 240a03069d6968741b703d026337ad2c
MIME type:application/x-dosexec
File name:_elementtree.pyd
File size:135'160 bytes
SHA256 hash: 5009a9a53c03ef8387443b5cf6ce08e5c3a79727466a0b931c5bbca915bf89ca
MD5 hash: b8925406de227ff5f760c323e49e3cb1
MIME type:application/x-dosexec
File name:_hashlib.pyd
File size:68'976 bytes
SHA256 hash: 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
MD5 hash: 72b2f8cdf8d6b1dbbdd4e0c0bacf849e
MIME type:application/x-dosexec
File name:libffi-8.dll
File size:39'696 bytes
SHA256 hash: eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 hash: 0f8e4992ca92baaf54cc0b43aaccce21
MIME type:application/x-dosexec
File name:python3.dll
File size:70'376 bytes
SHA256 hash: fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
MD5 hash: 962428e9e68d43ecc16f3e33f2ea8667
MIME type:application/x-dosexec
File name:_multiprocessing.pyd
File size:37'368 bytes
SHA256 hash: 2c636df7059cb0dd7e978dd735c7c5c8ddb09cf94754cf9e232296b96c5c545a
MD5 hash: 6d4d282a857f360ce222036aeb0dbb92
MIME type:application/x-dosexec
File name:pyexpat.pyd
File size:205'304 bytes
SHA256 hash: d615e193d1affcdbfe504e90d3621cbdcff94bf72b79d899126534507fd6d27a
MD5 hash: bf66989dd870664848467c327bdbe1a8
MIME type:application/x-dosexec
File name:core.dat
File size:927'857 bytes
SHA256 hash: dee26dbc889974ffc2a772b998a1e9431c92d8987c29b0b947ea72732a65d5be
MD5 hash: 4a87ad6c775f0c77bd8a076472c5b519
MIME type:application/octet-stream
File name:_bz2.pyd
File size:86'896 bytes
SHA256 hash: 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
MD5 hash: 2be172c3086efe56c7e1d3279142295a
MIME type:application/x-dosexec
File name:vcruntime140.dll
File size:120'400 bytes
SHA256 hash: 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 hash: 32da96115c9d783a0769312c0482a62d
MIME type:application/x-dosexec
File name:libssl-3.dll
File size:794'992 bytes
SHA256 hash: 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 hash: 8d4805f0651186046c48d3e2356623db
MIME type:application/x-dosexec
File name:_overlapped.pyd
File size:57'336 bytes
SHA256 hash: 662126ff80c3a1b4cedf74074029c12ae4743e6d3b37376e39ac70aacb7d4d3c
MD5 hash: a7fa2fbc0ae8c41a1911aed0703d37b7
MIME type:application/x-dosexec
File name:_zoneinfo.pyd
File size:49'656 bytes
SHA256 hash: 76f1439cda82ab6976df6ba505c4079444703f6d44d8b0259ce59c0ff4279fb4
MD5 hash: 4496465ef5a020fdfe084494163b90d5
MIME type:application/x-dosexec
File name:python312.dll
File size:6'945'272 bytes
SHA256 hash: 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
MD5 hash: de50496cece613ec7ebedbf9f2aefecd
MIME type:application/x-dosexec
File name:_ssl.pyd
File size:179'432 bytes
SHA256 hash: 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
MD5 hash: ed9242721197fd84231b38e6b42f3f55
MIME type:application/x-dosexec
File name:libcrypto-3.dll
File size:5'231'472 bytes
SHA256 hash: ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 hash: ae5b2e9a3410839b31938f24b6fc5cd8
MIME type:application/x-dosexec
File name:sqlite3.dll
File size:1'583'608 bytes
SHA256 hash: 8daa45684bf6688fca28d956b2e8942f2fa98f656675ce68e6d61dd869848a7a
MD5 hash: 8748951063b31a52634ac22d77072b1f
MIME type:application/x-dosexec
File name:select.pyd
File size:33'136 bytes
SHA256 hash: d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
MD5 hash: 74b93bc6c37d47011f92024f060c6784
MIME type:application/x-dosexec
File name:winsound.pyd
File size:31'736 bytes
SHA256 hash: 100e8d676777603c7258daf9b2f23ef001f09f1596d8708de359326fff72bddd
MD5 hash: 9cf81a5b6d20322ee5148131db59f587
MIME type:application/x-dosexec
File name:sitecustomize.pyc
File size:1'002 bytes
SHA256 hash: 1db35273ad134c116dcd1c24076c980434ea16696b6daba9628f67146aed30a2
MD5 hash: 1fb063abcb48b1808c693e90ce410b8e
MIME type:application/octet-stream
File name:_msi.pyd
File size:46'584 bytes
SHA256 hash: b49332bae154ebdd8c3d5e7ddfdde336d9c47f91ba028dc67bafb2420b3dbb5c
MD5 hash: 14685152f17c22d0f0fcb49c8652491b
MIME type:application/x-dosexec
File name:python.cat
File size:574'231 bytes
SHA256 hash: 5d85439736ae088d9680b391e2bca55ca7e9cc5b41a12ebe8e2f554506c7e72e
MD5 hash: 21cff1824a9afa92bc2a4f820657417c
MIME type:application/octet-stream
File name:unicodedata.pyd
File size:1'140'592 bytes
SHA256 hash: 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
MD5 hash: 24921918fa1451e9424881aa2867b175
MIME type:application/x-dosexec
File name:_sqlite3.pyd
File size:126'184 bytes
SHA256 hash: 64b51df2805c58b023a875e8ae3be7ac7f61ef664f32ca6c90f6315da47ef0bc
MD5 hash: ae09223d32af003b20889bd66a95b963
MIME type:application/x-dosexec
File name:_lzma.pyd
File size:161'136 bytes
SHA256 hash: e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
MD5 hash: 7c25a079b992919cc97221955dac050c
MIME type:application/x-dosexec
File name:python312._pth
File size:34 bytes
SHA256 hash: 19d8dda8190c0a7ebcbbcd41a4fc8fedd9a311593d248e66cafb1486cf990d93
MD5 hash: 109771a5227dfb93b586e59be5b2b716
MIME type:text/plain
File name:python312.zip
File size:3'835'482 bytes
SHA256 hash: fb131c0ef7e35cc5250a74c8cd18744bf4115fb8163710711f3758d7df3d1f88
MD5 hash: 73d869a42d5173e8c8c4d47063f2e440
MIME type:application/zip
File name:2
File size:1'349 bytes
SHA256 hash: 13160d8e413f8a06f47aec8b20edc6ea5d63b63190f77ae9a1ec1bed7195da79
MD5 hash: 7ef51f60309aa7899efdfed89aa1ad6f
MIME type:text/xml
File name:LICENSE.txt
File size:36'874 bytes
SHA256 hash: e502c6b880ff58d614901495a9009c136539cd0b1e2a2abb8fc00b934c203419
MD5 hash: b52c821c7750804295e23b9e94525085
MIME type:text/plain
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/7c880f7f-924f-466e-b8a4-c1c4ea977728/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6add164f5a22ac805bd9fa3b
Tags:
shellcode vmdetect
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b
Verdict:
Unknown
File Type:
iso
Link:
https://opentip.kaspersky.com/8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b/results?tab=lookup
Verdict:
Malware
YARA:
5 match(es)
Tags:
Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout T1059.005
Link:
https://app.malva.re/file/40f747b537eb469e2d106ec2e8bf4860
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=roelltusmp2jzpakf4c5ovfhlkda5fym5oplifwloz2zliosiunq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8b88b5ce9263f49cbc0a2f05d754a75a860e970ceb9eb416cb767595a1d2451b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__ConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:ldpreload
Create hunting rule
Author:xorseed
Reference:https://stuff.rop.io/
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments