MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6
SHA3-384 hash: 5df8d9dc6af014e5d1ffa8d9d53856e344df2fb15635f050bc2bf783648f6f3d1836f490a39a3c67e9a3a202bfdb09d5
SHA1 hash: 539e2c365cdd2b4abae50729794918c1ee4c1990
MD5 hash: eba2bbd380b6949a249aba5c3ed13245
humanhash: iowa-uncle-bacon-delta
File name:bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6.zip
Download: download sample
File size:6'383'775 bytes
First seen:2026-08-02 09:38:19 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:MVlkLaiaDs4iL3PjuyWO5zt0UO5cHTKaVmplnQ5msq4KRI/jSpM/eF3WKC8XqRkt:MVlzia44iLayWOQUHuodO8+WKtqO
TLSH T1BC563350A739E252E80AC1F916DC30BC19CCCD884535666E5BA83B66EC8F4F4AFDC857
Magika zip
Reporter JAMESWT_WT
Tags:89-124-79-98 zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
152
Origin country :
IT IT
File Archive Information

This file archive contains 17 file(s), sorted by their relevance:

File name:vcruntime140_1.dll
File size:47'264 bytes
SHA256 hash: e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash: 03b43160d21c08de07a79d0a1c5ee81d
MIME type:application/x-dosexec
File name:HelperStandardizationApplication.bin
File size:1'253'793 bytes
SHA256 hash: 2922837a8d049bf0b51f0f9b27340a377b27dd1912675e2cd82056db83ec7a19
MD5 hash: 14477fd8ce26e5251dddf34a003364bc
MIME type:application/octet-stream
File name:msvcp140_2.dll
File size:268'912 bytes
SHA256 hash: fbb8557f73ab9a207bd67643fdcf9ae34527325d227c53707cebdf0d1c8c4658
MD5 hash: f7b44650da2eb3b80cdda2ac699f4a0f
MIME type:application/x-dosexec
File name:wwide9.dll
File size:96'424 bytes
SHA256 hash: 5b71b49bad415643ff3e291ee3ba550e5edfd584eb913859dadb81634450e7e7
MD5 hash: 31c4eeb36c12d0784be6e21ee40a2b60
MIME type:application/x-dosexec
File name:msvcp140_1.dll
File size:35'976 bytes
SHA256 hash: ba0cd05bef6aa5f54f8e86a175742020a98e35a6df116402e5e31ff9e0e8d72b
MD5 hash: d508b529bbb3849032c7b3d41cb01360
MIME type:application/x-dosexec
File name:wwb9_64.dll
File size:3'163'264 bytes
SHA256 hash: 671ba5caae316b8abe01e4961eb48c9f5e4eac5a957619b30c18fc3d2f72966c
MD5 hash: 99b80a1ee18e33af9825b873537278a8
MIME type:application/x-dosexec
File name:model.dat
File size:1'218'590 bytes
SHA256 hash: 3b9b86feb3b789dda9cdfe5425ccb7e1feae9fde2cc158ff962991218a98f53f
MD5 hash: 1289b528f53c4b94f51a151ab1422797
MIME type:application/octet-stream
File name:vcruntime140.dll
File size:123'472 bytes
SHA256 hash: 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash: 0d35c5e99871b4f02c490b9fd9dace34
MIME type:application/x-dosexec
File name:WinWrapIDE.exe
File size:313'512 bytes
SHA256 hash: 0562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399f
MD5 hash: bfb25270df49bb391193a59281d5ffcf
MIME type:application/x-dosexec
File name:ucrtbase.dll
File size:997'056 bytes
SHA256 hash: 4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb
MD5 hash: ed82e9c6c4f7a475d7fd6ebabf3fab2a
MIME type:application/x-dosexec
File name:Xceed.Wpf.DataGrid.dll
File size:28'160 bytes
SHA256 hash: b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0
MD5 hash: 1db08732a7f63ba3487b10f7c13ebaaf
MIME type:application/x-dosexec
File name:concrt140.dll
File size:344'712 bytes
SHA256 hash: 8032b43bdd2f18ce7eb131e7cd542967081bea9490df08681bf805ce4f4d3aab
MD5 hash: 65f2e5a61f39996c4df8ae70723ab1f7
MIME type:application/x-dosexec
File name:msvcp140.dll
File size:553'552 bytes
SHA256 hash: def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash: 4e3fa9bd90ef020c14359639dc19312b
MIME type:application/x-dosexec
File name:ClLoca.dll
File size:51'712 bytes
SHA256 hash: 3d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7
MD5 hash: 3d393f2bdb67d15602a96a1496a82942
MIME type:application/x-dosexec
File name:mfc140u.dll
File size:5'651'104 bytes
SHA256 hash: fc9b1f94752d7080436824b480e83ba1ec930e3f7baa881f4e842b882e715cfc
MD5 hash: 90bd2d218dbd4a5532ab13dfe2a43839
MIME type:application/x-dosexec
File name:ComPDFKit.Viewer.dll
File size:57'344 bytes
SHA256 hash: 3466c3524f13cb3b7c87819e619bdb482ec9034a57bcdbe0240af6a9a530b02a
MD5 hash: 8dcb875c657f72e446d1ea88a1e8d82c
MIME type:application/x-dosexec
File name:wwb9$000.dll
File size:69'248 bytes
SHA256 hash: 1339e336618f8d2d396100b8d6275d497e9ba0b59cec922d9ddeaf8cae08da72
MD5 hash: 59ea8861093fce5bcd65371e9ffb502c
MIME type:application/x-dosexec
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/1f07004d-175b-4eb8-933d-99cedf7b58db/
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6
Verdict:
Clean
File Type:
zip
First seen:
2026-06-23T21:54:00Z UTC
Last seen:
2026-06-23T22:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6/results?tab=lookup
Score:
51%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-02 22:46:00 UTC
File Type:
Binary (Archive)
Extracted files:
996
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xv26flt6i6th2sbsyqe4pxiiid5vw2y22lihjn6ac5h3cgw4bpla._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://tria.ge/reports/260802-lqnndsgc73/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/bd75e2ae7e47a67d4832c409c7dd0840fb5b6b1ad2d074b7c0174fb11adc0bd6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETDLLMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments