MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f |
|---|---|
| SHA3-384 hash: | a4d3733aec785e556409b1dc8409b405cd942b926cc456ad4a8651da2e1a3973c3d6e7c3991d68f62ff4c5815cd25b90 |
| SHA1 hash: | 9d32f3248bef553b666e6b3c7e382ab151a16837 |
| MD5 hash: | ddc559ab995e489f7ad9c37d3203f0cf |
| humanhash: | foxtrot-connecticut-snake-lamp |
| File name: | Installer.35-12-5-64.exe |
| Download: | download sample |
| File size: | 156'280 bytes |
| First seen: | 2026-09-14 11:34:38 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 32f3282581436269b3a75b6675fe3e08 (198 x LummaStealer, 123 x Rhadamanthys, 8 x CoinMiner) |
| ssdeep | 3072:HfweqOYEUXPn4tvFGRfIyZR2di/YB+KYzK3pCW6WG:oEUXWvF2fJZR6K+16K3e |
| TLSH | T14CE3D04097F4C072F9F21EB429B19A621EB6FC010875D55FA308DEDE7931AD09D2AB1B |
| TrID | 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| dhash icon | 707168e086a6c440 |
| Reporter |  juroots |
| Tags: | exe signed |
Code Signing Certificate
| Organisation: | Rare Ideas, LLC |
|---|---|
| Issuer: | COMODO Code Signing CA 2 |
| Algorithm: | sha1WithRSAEncryption |
| Valid from: | 2012-02-16T00:00:00Z |
| Valid to: | 2013-02-15T23:59:59Z |
| Serial number: | 932fc9af0efa79d8a3f771681fe20334 |
| Thumbprint Algorithm: | SHA256 |
| Thumbprint: | 980d74b6de950edccdce315687c517b0f6b5bb648f057571fd2bebf151f6435a |
| Source: | This information was brought to you by ReversingLabs A1000 Malware Analysis Platform |
Intelligence
File Origin
# of uploads :
1
# of downloads :
132
Origin country :
CHVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
https://excel-solutionsgroup.co.uk/
Verdict:
Malicious activity
Analysis date:
2026-06-03 08:44:32 UTC
Tags:
phishing rmm-phish arch-exec
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Verdict:
Clean
Score:
89.3%
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a window
Verdict:
Clean
File Type:
exe x32
First seen:
2013-02-07T13:38:00Z UTC
Last seen:
2026-08-10T01:15:00Z UTC
Hits:
~100
Verdict:
Unknown
Score:
8%
Verdict:
Benign
File Type:
PE
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE Memory-Mapped (Dump)
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery
Behaviour
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f
MD5 hash:
ddc559ab995e489f7ad9c37d3203f0cf
SHA1 hash:
9d32f3248bef553b666e6b3c7e382ab151a16837
SH256 hash:
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
MD5 hash:
55a723e125afbc9b3a41d46f41749068
SHA1 hash:
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
SH256 hash:
227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
MD5 hash:
bd393029cc49b415b6c9aeb8a4936516
SHA1 hash:
c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SH256 hash:
720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
MD5 hash:
0deb397ca1e716bb7b15e1754e52b2ac
SHA1 hash:
fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
SH256 hash:
acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
MD5 hash:
2880bf3bbbc8dcaeb4367df8a30f01a8
SHA1 hash:
cb5c65eae4ae923514a67c95ada2d33b0c3f2118
SH256 hash:
c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 hash:
a88baad3461d2e9928a15753b1d93fd7
SHA1 hash:
bb826e35264968bbc3b981d8430ac55df1e6d4a6
SH256 hash:
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 hash:
132e6153717a7f9710dcea4536f364cd
SHA1 hash:
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SH256 hash:
ada2f1b1bd5f70e1244c7ed20d33ecfbdc85825221a28d8d4d60a18a9bbf3b5c
MD5 hash:
7249d7e787faf606c97f162b93a62448
SHA1 hash:
2be8ed1664e6f97b996a1623e609e5e92f93bceb
SH256 hash:
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 hash:
bf712f32249029466fa86756f5546950
SHA1 hash:
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SH256 hash:
41801c8f76a2335e9b0c71a584437ada288f3095e9fe876ff5791cfb8c5e48fd
MD5 hash:
6df7b107e750609d9d0ea89f425e5dd2
SHA1 hash:
9c0e0b239ac7beb33d9eb648deb9fa723685bfb9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Detect_NSIS_Nullsoft_Installer |
|---|---|
| Author: | Obscurity Labs LLC |
| Description: | Detects NSIS installers by .ndata section + NSIS header string |
| Rule name: | PE_Digital_Certificate |
|---|---|
| Author: | albertzsigovits |
| Rule name: | VECT_Ransomware |
|---|---|
| Author: | Mustafa Bakhit |
| Description: | Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.