MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848
SHA3-384 hash: c0e0ac66bff7e7d6a61f5085c10f180a01c0ec8b254c94c4a7eea70ff163e06d31d0ec714d319b1d5288e7bf45e66e85
SHA1 hash: c24f1cc0e1c51eca1999a9409808f8da1f7a560c
MD5 hash: c5145178e6e8e3ebccdc93e4fe4311f6
humanhash: minnesota-yellow-whiskey-oxygen
File name:University of Alberta Gov. of Alberta.zip
Download: download sample
File size:13'650'945 bytes
First seen:2026-08-11 11:09:26 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 393216:ZAhRn3kfF9hhFF+BLS1fuYzBo4Cbjr4Smxz5G:ZAhOffFiwuKyb/4SX
TLSH T101D63321C47E08E4D570EF963F4EAE6EC3A2D8B433ED758224C5461E47A9B34A36193D
Magika zip
Reporter Anonymous
Tags:zip


Avatar
Anonymous
Vulnerability Assessment // University of Alberta & Government of Alberta (Alberta NDP & Alberta UCP)

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
CA CA
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6d5e7646-cb55-4f3c-94bb-dbdb38962609/
Result
Verdict:
Clean
File Type:
PDF File
Link:
https://app.docguard.net/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm
Link:
https://www.filescan.io/uploads/6a7b032b051c0f401a8ad6fa/reports/acf63ea3-c8db-45b7-bf0a-277c146a53b9/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848/results?tab=lookup
Score:
1%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v3soevupnrv7365v5l3wjg23bjqtd2iztmp3gzhonixw7kqerbea._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
adware discovery link pdf spyware
Link:
https://tria.ge/reports/260811-pj63yasgjh/
Behaviour
Checks processor information in registry
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:test_rule_vldslv
Create hunting rule
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Link
https://www.virustotal.com/gui/file/aee4e2568f6c6bfdfbb5eaf7649b5b0a6131e9199b1fb364ee6a2f6faa048848/relations
  
Delivery method
Multiple

Comments