MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 2

Intelligence 2 IOCs YARA 1 File information Comments

SHA256 hash:	d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6
SHA3-384 hash:	4ffb8a2d9b4f8d81f81f31e10691852c6ee12dcae9eb6f9433c5d8ba1d3d799aced4f5db5b87275f359da448d7ed3b41
SHA1 hash:	325d0d64493d61375858ff812d61575ab3d5f9ae
MD5 hash:	d9debefbcf7a77436bb62a9af5dd19bd
humanhash:	nine-grey-mango-seventeen
File name:	api.exe
Download:	download sample
File size:	6'144 bytes
First seen:	2026-09-12 16:58:23 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8d70e9948c196d328770a1903d8756c2
ssdeep	96:40Epu8y86WaBQ7QtJqXrnHbBxApwv75hAVU:Uup861dq7nHtxiwv73Au
TLSH	T124C1842EF717246AE52AD27854EF4531B8A6781123704B3F53AAE4313C25A61943DA08
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	ffforward
Tags:	dropped-by-wailsloader exe lolbin-target native-loader WailsLoader X64

ffforward

Standalone MinGW x64 loader dropped to C:\ProgramData\WinApi\api.exe and invoked via LOLBin Register-CimProvider.exe. Instantiates the registered PSCom52.dll COM engine via CoGetObject.

Intelligence

File Origin

# of uploads :

# of downloads :

172

Origin country :

Vendor Threat Intelligence

Gathering data

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-12 17:03:02 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9bc13b53-f398-4eaf-96d8-fc3f28f0373b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/85202/

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d5cd174d-4e48-4ef8-bd77-f59613204ae7

Score:

21%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/d9debefbcf7a77436bb62a9af5dd19bd

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2fmfvryu54xvxua6fj4cyfccwgellmgfybukxsi66scegs535d3a._file

Gathering data

Unpacked files

SH256 hash:

d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6

MD5 hash:

d9debefbcf7a77436bb62a9af5dd19bd

SHA1 hash:

325d0d64493d61375858ff812d61575ab3d5f9ae

Link:

https://www.unpac.me/results/314085e5-6547-4909-b1fe-e7f29a90c8af/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/d1585ac714ef2f5bd01e2a782c1442b188b5b0c5c068abc91ef484434bbbe8f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.