MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd
SHA3-384 hash: 88cee9927f073676ec35739e7be7b1bc65572979f44fd55c0f0acb2364c27298dab0919fa95e16e415a10e7b7e94fd85
SHA1 hash: 05d4b3024d88d4a03444cdd24efdd39a701d74d2
MD5 hash: 960d2d40bb811a177ba11e1acbfbb252
humanhash: music-tennis-hotel-utah
File name:spr_conview_v0.11.zip
Download: download sample
File size:289'954 bytes
First seen:2025-12-12 08:17:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:LS4+PdTYSIOCdL8cka551kCGeHfRIE87AsFLdVI1ZaeV0m:2l+OSpH557GKRe5FLdVX1m
TLSH T1795423CDBA98D3B9E1D1C62E1F754458B0182D6054BEFC1C0ECB4299FE82BBB4542D9B
Magika zip
Reporter juroots
Tags:zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
RO RO
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SPR_Conview_v0.11.exe
File size:590'848 bytes
SHA256 hash: fc6ac19c444d34a3b0a08c2104cb239774a266b94917d418052f1e62dd6cb65c
MD5 hash: e5568ffc2e61b3514322424e4cdec46b
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fca9f0a7-3d57-4aa7-a3d1-6852b0140238/
Verdict:
Malicious
Score:
70%
Link:
https://cyber-fortress.com/docs/result/index.php?id=693bcfe2a675b653bd10589e
Tags:
malware
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug borland_delphi fingerprint keylogger packed
Link:
https://www.filescan.io/uploads/693bcfda64bd958a52108bc7/reports/85ef0a68-fb28-4c4a-b292-ba4679f87081/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=terbrkhc6fdmri3kd2hmzwohk6yhicsct3xo2trdrpee7u6pm66q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251212-k2vemscy7g/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

zip 992218a8e2f146c8a36a1e8eccd9c757b0740a429eeeed4e238bc84fd3cf67bd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3732129/
  
Delivery method
Distributed via web download

Comments