🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839
SHA3-384 hash: 384208bcb9d0bbba2a1e2c553da1b8b6779d837321682c56fc23ca37a2a284eb015cfa9791b77475688f30c2bf5a62f6
SHA1 hash: 5cc466d6b8aa21a3b09a7947e532fbb08738d41c
MD5 hash: eb8187969e04d2d6abc6b979a498ffc6
humanhash: johnny-nuts-yankee-romeo
File name:bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839.exe
Download: download sample
File size:9'728 bytes
First seen:2026-09-21 14:08:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 192:Eo9RUmGgCu49t3awPy5baBVHbA2Cxl6GHi15EvFv:EkG3VtKl0BVHbLEljQ5
TLSH T1D712E90A07D29A24C505D13819078B72C633B9392B7326F71696CE670ADD5CA36BFB4E
TrID 51.9% (.EXE) Win64 Executable (generic) (6522/11/2)
16.1% (.EXE) OS/2 Executable (generic) (2029/13)
15.9% (.EXE) Generic Win/DOS Executable (2002/3)
15.9% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter whack_sh
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
https://sites.google.com/view/transportdocumenten-nova
Verdict:
Malicious activity
Analysis date:
2026-09-21 13:45:09 UTC
Tags:
stealer moiclient backdoor auto generic bootrepair-sys vuln-driver github
Link:
https://app.any.run/tasks/11b4b1ab-6f00-4023-a124-690047823add

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/88011/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
expand lolbin packed
Link:
https://www.filescan.io/uploads/6ab13a8d85b878e0b17a38cc/reports/0ec42408-c243-41ad-a664-4e4fdceca7e5/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839
Verdict:
Clean
File Type:
dll x64
First seen:
2026-09-19T15:46:00Z UTC
Last seen:
2026-09-23T10:07:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ae2cd9ee-4966-4396-bff9-c3aca4be86da
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1975593
Signature
Found direct / indirect Syscall (likely to bypass EDR)
Sigma detected: RunDLL32 Spawning Explorer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1975593 Sample: PFdy9p0Wc4.exe Startdate: 21/09/2026 Architecture: WINDOWS Score: 48 41 mr-b01.tm-azurefd.net 2->41 43 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->43 47 Sigma detected: RunDLL32 Spawning Explorer 2->47 9 loaddll64.exe 1 2->9         started        signatures3 process4 signatures5 49 Found direct / indirect Syscall (likely to bypass EDR) 9->49 12 rundll32.exe 9->12         started        14 rundll32.exe 9->14         started        16 cmd.exe 1 9->16         started        18 13 other processes 9->18 process6 process7 20 WerFault.exe 20 16 12->20         started        23 explorer.exe 12->23         started        25 WerFault.exe 16 14->25         started        27 explorer.exe 14->27         started        29 rundll32.exe 16->29         started        31 explorer.exe 18->31         started        33 explorer.exe 18->33         started        35 explorer.exe 18->35         started        37 7 other processes 18->37 dnsIp8 45 mr-b01.tm-azurefd.net 150.171.109.183, 443, 49721, 49722 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 20->45 39 explorer.exe 29->39         started        process9
Score:
23%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/eb8187969e04d2d6abc6b979a498ffc6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-21 14:07:10 UTC
File Type:
PE+ (Dll)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x4lezgzg5dhbk7gc4dklirvapd33h4hzruqlrjaqg74dbbnhja4q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260921-rf9e1avhjb/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839
MD5 hash:
eb8187969e04d2d6abc6b979a498ffc6
SHA1 hash:
5cc466d6b8aa21a3b09a7947e532fbb08738d41c
Link:
https://www.unpac.me/results/b41a83fc-18cc-4d5d-a359-d5d3c85cfb25/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe bf164c9b26e8ce157cc2e0d4b446a078f7b3f0f98d20b8a41037f83085a74839

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/88011/

Comments