MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b
SHA3-384 hash:	c83affb25533605308f720eb0216aa72ad984af4bcb575d023647438c79d713d09dbfcc3d8fb9008c20d66f8722af8c5
SHA1 hash:	556c81d57671b2e473adf7b4f6f82bf3f2a7fbb1
MD5 hash:	bc24fbc8fc7ca5d1264f133a69e42bb2
humanhash:	fix-fanta-pluto-quebec
File name:	Pemberitahuan Penyesuaian Gaji.7z
Download:	download sample
File size:	595'752 bytes
First seen:	2026-03-03 09:44:30 UTC
Last seen:	Never
File type:	7z
MIME type:	application/x-7z-compressed
ssdeep	12288:qbMyAaIew2A1XaCriCnErgX07vKV9CUPGAcSGqdJjacgWfIdmO/QD:uMVOKZ+FrjiV9CN6/dJjwLi
TLSH	T1CEC423511362A9BACB3F09FC55E27AE0A5E72DD11F524F68852AC3DD3E2B7C1221C784
TrID	57.1% (.7Z) 7-Zip compressed archive (v0.4) (8000/1) 42.8% (.7Z) 7-Zip compressed archive (gen) (6000/1)
Magika	sevenzip
Reporter	juroots
Tags:	7z

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

73

Origin country :

RO

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

Potential files of interest 1

File name:	64位安装包_特別版.exe
File size:	1'392'640 bytes
SHA256 hash:	127dd850103b7147ece722995b407ee9e3df94d2d59cbbdb6c9613183e120600
MD5 hash:	4930d1925e4b4dcd58f08adc65095c35
MIME type:	application/x-dosexec

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.FileRepMalware.18398138.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69a6f1bce1f958bf668327e6

Tags:

dropper virus

DocGuard Suspicious

Result

Verdict:

Suspicious

File Type:

PE File

Link:

https://app.docguard.net/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b/results/dashboard

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 cmd evasive evasive exploit explorer fingerprint installer-heuristic lolbin microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/69a6adb610e80629d4f9ff87/reports/d3ec055f-0825-42e3-8e53-b232f6613b39/overview

Hybrid Analysis Trojan.Win64.Agent

Verdict:

Suspicious

Labled as:

Trojan.Win64.Agent

Link:

https://www.hybrid-analysis.com/sample/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

7z

Link:

https://opentip.kaspersky.com/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b/results?tab=lookup

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

7z Archive Executable PDB Path PE (Portable Executable) PE File Layout SFX 7z

Link:

https://app.malva.re/file/bc24fbc8fc7ca5d1264f133a69e42bb2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b/

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-03 04:53:56 UTC

File Type:

Binary (Archive)

Extracted files:

36

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xkmds7ntuzfxbas2jxwpemx3aahtxi7pjovorqcrtxww6iktqifq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

n/a

Link:

https://tria.ge/reports/260303-pxf4nsat9l/

Behaviour

Looks up external IP address via web service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b