🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.OfferCore


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca
SHA3-384 hash: 2560e918d8bf766fc39899fcb106e21dde0bc931637085ae235b14e75a630621a6eca6e06ea6ab65a15f588f52273c6c
SHA1 hash: 2f96166fb355b92e4358bee0dd191b46501b1a70
MD5 hash: ecb20bf55b95b24664cb83d9a15b9c97
humanhash: don-wyoming-mike-twelve
File name:9ba0ffb9e9cc6c00.bin
Download: download sample
Signature Adware.OfferCore
Create hunting rule
File size:2'132'080 bytes
First seen:2026-10-23 03:25:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (31 x ValleyRAT, 24 x Adware.OfferCore, 21 x OffLoader)
ssdeep 24576:lXNrSLScusMmOvjjhzvLVAOgLgkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64a:muI2hREHcTeynRkfg7ve+AhrWzOUq
TLSH T14DA5D03FB28B653EE06E5A367A72E210583B7A6165138C5696F4C88CCF254701E3F787
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon b36494a8cca2cc4d (14 x Adware.OfferCore, 6 x RedLineStealer, 1 x RaccoonStealer)
Reporter Tuxxin
Tags:Adware.OfferCore exe signed

Code Signing Certificate

Organisation:SOFTONIC INTERNATIONAL SA
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-28T00:00:00Z
Valid to:2027-01-28T23:59:59Z
Serial number: c3607b2510e7ab39ff16c1998bbf0c85
Intelligence: 13 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b1e1dbb1624601638e698d1bf0c4e080eb335e6fb4dd29df68ab6951a96452e7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4ee82e42-ba18-4a34-b897-a0a956fc5fd7/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-23 03:32:23 UTC
Tags:
installer offercore adware innosetup delphi
Link:
https://app.any.run/tasks/6f196d23-357e-488d-8fd2-2be9a2b14200

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/94207/
Detection(s):
SecuriteInfo.com.Adware.Downware.20879.29.14062.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6adad3a8afb06e650cd8ca94
Tags:
shellcode injection dropper delphi
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Creating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca
Verdict:
Adware
File Type:
exe x32
First seen:
2026-10-23T15:25:00Z UTC
Last seen:
2026-10-24T18:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4f0075d1-20ff-4bbf-b112-1d455fd3fdec
Result
Threat name:
n/a
Detection:
suspicious
Classification:
rans.evad
Score:
34 / 100
Link:
https://www.joesandbox.com/analysis/1990830
Signature
Contains functionality to infect the boot sector
Detected potential unwanted application
Installs a global event hook (focus changed)
Multi AV Scanner detection for submitted file
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1990830 Sample: 9ba0ffb9e9cc6c00.bin.exe Startdate: 23/10/2026 Architecture: WINDOWS Score: 34 179 vlc-media-player.en.softonic.com 2->179 181 images.sftcdn.net 2->181 183 29 other IPs or domains 2->183 213 Multi AV Scanner detection for submitted file 2->213 215 Detected potential unwanted application 2->215 217 Writes many files with high entropy 2->217 15 9ba0ffb9e9cc6c00.bin.exe 2 2->15         started        18 svchost.exe 14 2->18         started        20 explorer.exe 2->20 injected 22 AvEmUpdate.exe 2->22         started        signatures3 process4 file5 173 C:\Users\user\...\9ba0ffb9e9cc6c00.bin.tmp, PE32 15->173 dropped 24 9ba0ffb9e9cc6c00.bin.tmp 5 23 15->24         started        29 WerFault.exe 18->29         started        31 WerFault.exe 18->31         started        process6 dnsIp7 193 swls.map.fastly.net 151.101.1.91, 443, 49748, 49750 FASTLY-FastlyIncUS Canada 24->193 195 d2it9arwsniqaq.cloudfront.net 99.84.169.140, 443, 49741, 49742 AMAZON-02-AmazoncomIncUS United States 24->195 149 C:\Users\...\cookie_mmm_irs_ppi_008_585.exe, PE32 24->149 dropped 151 C:\Users\user\...\component0.zip (copy), Zip 24->151 dropped 153 C:\Users\user\AppData\...\component0 (copy), Zip 24->153 dropped 155 3 other files (1 malicious) 24->155 dropped 225 Writes many files with high entropy 24->225 33 cookie_mmm_irs_ppi_008_585.exe 6 42 24->33         started        38 OperaGXSetup.exe 2 24->38         started        40 WerFault.exe 24->40         started        42 WerFault.exe 24->42         started        file8 signatures9 process10 dnsIp11 175 cdip.cdippd.nortonalto.com 52.72.139.238, 443, 49755, 49756 AMAZON-AES-AmazoncomIncUS United States 33->175 177 e337078.dscd.akamaiedge.net 23.44.203.22, 443, 49754 AKAMAI-ASN1NL United States 33->177 107 C:\Windows\Temp\...\icarus.exe, PE32+ 33->107 dropped 109 C:\Windows\Temp\...\setupui.cont, XZ 33->109 dropped 111 C:\...\fb728978-940a-455f-866e-bab90d0a1e0f, LZMA 33->111 dropped 115 9 other files (5 malicious) 33->115 dropped 219 Contains functionality to infect the boot sector 33->219 221 Writes many files with high entropy 33->221 44 icarus.exe 33->44         started        113 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 38->113 dropped 49 installer.exe 77 38->49         started        file12 signatures13 process14 dnsIp15 197 8.8.8.8 GOOGLE-GoogleLLCUS United States 44->197 199 34.160.176.28 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 44->199 205 4 other IPs or domains 44->205 157 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 44->157 dropped 159 C:\Windows\Temp\...\icarus_product.dll, PE32+ 44->159 dropped 161 C:\Windows\Temp\...\icarus.exe, PE32+ 44->161 dropped 169 13 other files (8 malicious) 44->169 dropped 231 Writes many files with high entropy 44->231 51 icarus.exe 44->51         started        55 icarus.exe 44->55         started        201 submit-trn.osp.opera.software 107.167.125.189, 443, 49757, 49760 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 49->201 203 na-download.opera.com 107.167.96.36, 443, 49764 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 49->203 207 5 other IPs or domains 49->207 163 C:\Users\user\AppData\Local\...\opera_package, PE32 49->163 dropped 165 C:\Users\...\77EC63BDA74BD0D0E0426DC8F8008506, Microsoft 49->165 dropped 167 Opera_GX_assistant....exe_sfx.exe (copy), PE32 49->167 dropped 171 2 other files (none is malicious) 49->171 dropped 58 installer.exe 49->58         started        60 Opera_GX_assistant_137.0.6036.65_Setup.exe_sfx.exe 49->60         started        62 assistant_installer.exe 49->62         started        64 2 other processes 49->64 file16 signatures17 process18 dnsIp19 117 C:\...\uiLangRes.dll.ipending.2a9d7749, PE32+ 51->117 dropped 127 203 other files (157 malicious) 51->127 dropped 223 Writes many files with high entropy 51->223 66 AvEmUpdate.exe 51->66         started        70 AvEmUpdate.exe 51->70         started        191 23.48.224.68 AKAMAI-ASN1NL United States 55->191 119 C:\...\uiext.dll.ipending.7f129f74, PE32+ 55->119 dropped 121 C:\...\swhealthex2.dll.ipending.7f129f74, PE32+ 55->121 dropped 123 C:\...\protobuf.dll.ipending.7f129f74, PE32+ 55->123 dropped 129 170 other files (135 malicious) 55->129 dropped 72 engsup.exe 55->72         started        125 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 58->125 dropped 131 20 other files (none is malicious) 58->131 dropped 74 installer.exe 58->74         started        77 installer.exe 58->77         started        133 5 other files (none is malicious) 60->133 dropped 79 assistant_installer.exe 62->79         started        file20 signatures21 process22 dnsIp23 185 34.111.175.102 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 66->185 187 23.210.73.53 AKAMAI-ASN1NL United States 66->187 189 3 other IPs or domains 66->189 135 C:\...\BC8CEB632D911E661D94BDAD75B26A07.rmt, data 66->135 dropped 137 C:\...\BE2C6C99B5F6E6CB53AFF52C314C8B56.rmt, data 66->137 dropped 139 471AC984A9FBFA5EBB...7DEAD8BCE454D8EAF0E, PE32+ 66->139 dropped 147 5 other files (none is malicious) 66->147 dropped 141 C:\Users\user\AppData\Local\...\opera.exe, PE32+ 74->141 dropped 143 C:\Users\user\...\opera_autoupdate.exe, PE32+ 74->143 dropped 145 opera_autoupdate.e...92734230.old (copy), PE32+ 74->145 dropped 227 Installs a global event hook (focus changed) 74->227 229 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 74->229 81 assistant_installer.exe 74->81         started        84 installer.exe 74->84         started        86 opera.exe 74->86         started        file24 signatures25 process26 file27 99 C:\Users\user\AppData\Local\...\msdia140.dll, PE32 81->99 dropped 101 C:\Users\user\AppData\Local\...\dbghelp.dll, PE32 81->101 dropped 103 C:\Users\user\AppData\Local\...\dbgcore.dll, PE32 81->103 dropped 105 2 other files (none is malicious) 81->105 dropped 88 assistant_installer.exe 81->88         started        90 assistant_installer.exe 81->90         started        process28 process29 92 browser_assistant.exe 88->92         started        95 assistant_installer.exe 88->95         started        dnsIp30 209 107.167.96.43 OPERASOFTWARE-OperaSoftwareAmericasLLCUS United States 92->209 211 127.0.0.1 unknown unknown 92->211 97 opera.exe 92->97         started        process31
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ecb20bf55b95b24664cb83d9a15b9c97
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca/
Threat name:
Win32.PUA.OfferCore
Create hunting rule
Status:
Suspicious
First seen:
2026-10-20 22:49:50 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
13 of 24 (54.17%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=toqp7opjzrwaaajdtvsh6xs2lj7sfulcpggigex4mxrrz5k447fa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
bootkit defense_evasion discovery installer persistence spyware stealer trojan
Link:
https://tria.ge/reports/261023-d6m3ssbx7k/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Modifies system certificate store
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Direct Volume Access: Opens a physical disk for reading
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Time Discovery
Checks for any installed AV software in registry
Checks installed software on the system
Enumerates connected drives
Writes to the Master Boot Record (MBR)
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Writes a Windows system DLL name to a user directory
Downloads MZ/PE file
Unpacked files
SH256 hash:
9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca
MD5 hash:
ecb20bf55b95b24664cb83d9a15b9c97
SHA1 hash:
2f96166fb355b92e4358bee0dd191b46501b1a70
Link:
https://www.unpac.me/results/bf48b2c7-f38f-4903-afa1-95451027d81f/
SH256 hash:
021ea410a61e029c04e5e2a8eaccb93e0028a359045a1445ea954b11df8b4daa
MD5 hash:
d3ecfe682582de40c79136c9cc18a9f4
SHA1 hash:
c039f4f4bc3714260601b616c9721078fe511c58
Link:
https://www.unpac.me/results/bf48b2c7-f38f-4903-afa1-95451027d81f/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/bf48b2c7-f38f-4903-afa1-95451027d81f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.OfferCore

Executable exe 9ba0ffb9e9cc6c0001239d647f5e5a5a7f22d162798c8312fc65e31cf55ce7ca

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/94207/

Comments