MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c04bbc0b6bfc8c331542687bc4bad32b4daaa7d84e94b5b93ee8a0a9d90f2be5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	c04bbc0b6bfc8c331542687bc4bad32b4daaa7d84e94b5b93ee8a0a9d90f2be5
SHA3-384 hash:	6367e23a84846f32f3301fbe283cebf13ae588a753ad7e12ea5ee6d0281e0cfa6d811b71ae1421401c0db782819d2b0f
SHA1 hash:	7ce7bd60773e2e1348b1f5515530e4afa4da5d93
MD5 hash:	de873b8466134c24f3563649252cbb20
humanhash:	berlin-seven-foxtrot-sink
File name:	SecuriteInfo.com.FileRepMalware.44148141
Download:	download sample
File size:	438'272 bytes
First seen:	2026-05-16 20:39:57 UTC
Last seen:	2026-05-16 21:40:15 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	12288:atKRQ+gjpjeg2Oo8snRNgnG6v0l11c2IIx:atMcpV2OignG6vXV
TLSH	T18B94CF623BC9C13AD39A063785BB97A626767C750B30D0CB7BA07D6C5E306D2A975303
TrID	98.2% (.MSI) Microsoft Windows Installer (454500/1/170) 1.7% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	SecuriteInfoCom
Tags:	msi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c04bbc0b6bfc8c331542687bc4bad32b4daaa7d84e94b5b93ee8a0a9d90f2be5

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

File Type:

msi

Link:

https://opentip.kaspersky.com/c04bbc0b6bfc8c331542687bc4bad32b4daaa7d84e94b5b93ee8a0a9d90f2be5/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	win_samsam_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator