MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa
SHA3-384 hash: f88d52ec73528ba4671950cdc692ea6decee7f9cfe5a3202f0bf5fa3c5947aff5bd7ef478edf1bd983f544a012b9fa4f
SHA1 hash: daaeb29e46c84af8520df0b77f3792aef702a24d
MD5 hash: b81a0f82c92ea2b8bce41e56c54e339d
humanhash: spaghetti-iowa-six-hotel
File name:rPurchase_Order.bat
Download: download sample
File size:1'118'720 bytes
First seen:2026-01-19 08:30:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'750 x AgentTesla, 19'656 x Formbook, 12'248 x SnakeKeylogger)
ssdeep 24576:gu2mQsANKbPPPp5MlUcwNPDsqcPQ08GvulPfARRRymFEI1:gHmlCYxcQI1Pj/vulbmd
TLSH T19435126A6B4DCE07D89147B80A74E37513BD6D9EE831C3528EE97DEB3C38A049844393
TrID 35.4% (.EXE) Win64 Executable (generic) (10522/11/4)
22.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.1% (.EXE) Win32 Executable (generic) (4504/4/1)
6.9% (.ICL) Windows Icons Library (generic) (2059/9)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter FXOLabs
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
135
Origin country :
BR BR
Vendor Threat Intelligence
Malware configuration found for:
RoboSki
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e93bb93e-dbb7-49c7-b466-cc9ced20152a/
Malware family:
n/a
ID:
1
File name:
rPurchase_Order.bat
Verdict:
Malicious activity
Analysis date:
2026-01-19 08:32:00 UTC
Tags:
auto-startup netreactor purehvnc
Link:
https://app.any.run/tasks/4fa5ad17-0aa8-4d8f-afb3-ad402bc1b7c8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/49302/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=696debb4bcad3327ec064bed
Tags:
autorun micro shell spawn
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
masquerade obfuscated packed
Link:
https://www.filescan.io/uploads/696debb0fdafd7624ab0a1b3/reports/981e1998-9c8f-44e1-b803-3f7b8f2a468b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-01-19T05:37:00Z UTC
Last seen:
2026-01-19T17:11:00Z UTC
Hits:
~10
Detections:
Trojan.MSIL.Agent.sb HEUR:Trojan.WinLNK.Powecod.e PDM:Trojan.Win32.Generic HEUR:Trojan-PSW.MSIL.Agensla.gen Trojan.Win32.Agent.sb Trojan.MSIL.Inject.sb Trojan.MSIL.Crypt.sb
Link:
https://opentip.kaspersky.com/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/15065511-c2ae-44b4-a6f0-7ba5f6956f4a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa
Verdict:
inconclusive
YARA:
10 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.45 Win 32 Exe x86
Link:
https://app.malva.re/file/b81a0f82c92ea2b8bce41e56c54e339d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa/
Verdict:
Malicious
Threat:
Family.PUREHVNC
Link:
https://tip.neiki.dev/file/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa
Threat name:
ByteCode-MSIL.Trojan.PureLogStealer
Create hunting rule
Status:
Malicious
First seen:
2026-01-19 08:24:01 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=urit73krbmoldfa7pssbclkxl3ri6e73i5rwybjiaslh4pugrgva._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/260119-kej1dset9c/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
Checks computer location settings
Drops startup file
Command and Scripting Interpreter: PowerShell
Verdict:
Unknown
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/125644ef-8b6c-474a-81ac-40346bf0a77e
Unpacked files
SH256 hash:
a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa
MD5 hash:
b81a0f82c92ea2b8bce41e56c54e339d
SHA1 hash:
daaeb29e46c84af8520df0b77f3792aef702a24d
Link:
https://www.unpac.me/results/6ed46c82-bb70-4354-ac76-f0c6cecac0aa/
SH256 hash:
709212affd1086f3b7f12df5220486c84d7bf0231d74b051753cd3cc00fa03ee
MD5 hash:
c2b0dfa0b904839f9744a326f3af5cee
SHA1 hash:
5427f5c014df7ad3d7ff35cd2a1b767712160051
Link:
https://www.unpac.me/results/6ed46c82-bb70-4354-ac76-f0c6cecac0aa/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a4513fed510b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe a4513fed510b1cb1941f7ca4112d575ee28f13fb47636c052804967e3e8689aa

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/49302/

Comments