MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 7 File information Comments

SHA256 hash:	9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129
SHA3-384 hash:	1f8caeb81019ea7c77799ae3f662be32111c7773dcc899cf43aa8f17e2f6d70bf0ce5f9c3e7607383638df18ee32c6be
SHA1 hash:	867f19fdd663cc4d589ca54b5ca1bca56979b145
MD5 hash:	8772dce19de3eec069559fe06557572d
humanhash:	juliet-purple-kitten-hot
File name:	IMG_958742253158.scr
Download:	download sample
File size:	439'008 bytes
First seen:	2026-10-15 17:16:50 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	669be9f29dcbe71721164fb8b8e8b304
ssdeep	6144:NZz0G5YAAKapwLu4Aa/0kxgh6tCDNrzgel8d3+GMC8vON0d4NWSVLyztM3G:/0GeGLujuxgYUp8qLC20vWUmzt7
TLSH	T1E994D012B66A11FAE36AA635C5918606FF72BC62075169CF17903EF74E336D08E3E701
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	00213b1b1b373b00
Reporter	devmihaylov
Tags:	cab dropper EV-signed RAT revoked-cert scr signed

Code Signing Certificate

Organisation:	SOFTWARE DYNAMICS AS
Issuer:	Certum Extended Validation Code Signing 2021 CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-03-18T07:32:04Z
Valid to:	2027-03-18T07:32:03Z
Serial number:	4a2d7e6fc1a8b27198364cd067f22b58
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	46d984c67c67bb5ea4b71daee68caa7e37b20d9ac7c20149f59754b74a5d773c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

devmihaylov

Certum EV-signed x64 .scr posing as Advanced Photo Viewer by SOFTWARE DYNAMICS AS (certificate since revoked), which drops and opens an AES-256-CBC-decrypted phone-call PNG decoy while fetching a junk-padded cabinet from an AES-encrypted URL over WinHTTP. It strips the junk, unpacks the cab from memory into %LOCALAPPDATA%\Wavesoft\<UUID>\ and starts winsec.exe, a stock pythonw that autoloads a Python Socket.IO RAT through sitecustomize.py, see https://any.run/report/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129/2af2b954-72a8-475d-b94c-a726d8ded008

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

IMG_958742253158.scr

Verdict:

Malicious activity

Analysis date:

2026-10-15 14:12:33 UTC

Tags:

arch-scr python openssl tool websocket

Link:

https://app.any.run/tasks/2af2b954-72a8-475d-b94c-a726d8ded008

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92161/

Detection(s):

SecuriteInfo.com.Adware.Downware.20902.15632.28660.UNOFFICIAL

Verdict:

Clean

Score:

70.0%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad1a7eff4e17c78f7161b9d

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Launching a process

DNS request

Creating a window

Connection attempt

Sending a custom TCP request

Searching for the window

Sending an HTTP GET request

Creating a process from a recently created file

Moving a recently created file

Launching a service

Creating a file in the %temp% subdirectories

Running batch commands

Creating a process with a hidden window

Launching the process to interact with network services

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-debug anti-vm explorer hacktool lolbin masquerade microsoft_visual_cc packed revoked-cert signed

Link:

https://www.filescan.io/uploads/6ad10a997d74d21d8afe3fb8/reports/80cb80b0-dde1-4bdc-a4e4-f6b9ead0498f/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129

Verdict:

Clean

File Type:

exe x64

First seen:

2026-10-07T11:08:00Z UTC

Last seen:

2026-10-17T14:34:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/8b2c63c5-6c08-44ab-8539-9c9149c8a911

Score:

27%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/8772dce19de3eec069559fe06557572d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tnb3wtrcwq4o6khkihzjy5k5oguclfimocqr7kofnhoqfpfjceuq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery execution persistence privilege_escalation

Link:

https://tria.ge/reports/261015-vtthgsty2m/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Creates a file in the Startup directory

Unpacked files

SH256 hash:

9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129

MD5 hash:

8772dce19de3eec069559fe06557572d

SHA1 hash:

867f19fdd663cc4d589ca54b5ca1bca56979b145

Link:

https://www.unpac.me/results/e30fcb65-b695-4347-bdec-85abdca1dd3b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9b43bb4e22b438ef28ea41f29c755d71a825950c70a11fa9c569dd02bca91129

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	certum_issuer Create hunting rule
Author:	Certum
Description:	Looks for files signed with certificate issued by Certum

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_certum_issuer Create hunting rule
Author:	Certum
Description:	Looks for files signed with certificate issued by Certum

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.