MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a
SHA3-384 hash:	5c1b66c51f1614d368d99f87a0ab0daf6861e947d8deaae812fd10f7b523ee5c1e0357f8b8659cac6cf5a75cd11aa0f1
SHA1 hash:	a9b24639f7c1e66d0c2d4555151126402d402ed0
MD5 hash:	28e5fc5107699ce290169776596b806e
humanhash:	xray-triple-march-summer
File name:	Oficio_20392302026.exe
Download:	download sample
File size:	84'950'424 bytes
First seen:	2026-03-30 20:39:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	88016fcdef7f227c62171d0afad9aae4 (5 x OffLoader, 3 x Gh0stRAT, 3 x ValleyRAT)
ssdeep	1572864:pW7mT8Psdhx+WQXmyAj+cCWgAv3M5J5ilWJ0bsbvmqEN4BkF1EZDOLLh:AmgsMPXmr+cCWBv3KCdb4p8LLh
TLSH	T18218333BE18A6579E06E2D363572E210943FBE5169030C1B96FCB04CDF356B11E3EA96
TrID	50.8% (.EXE) Inno Setup installer (107240/4/30) 20.4% (.EXE) InstallShield setup (43053/19/16) 19.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.0% (.EXE) Win64 Executable (generic) (6522/11/2) 2.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	5050d270cccc82ae (112 x Adware.Generic, 70 x OffLoader, 43 x LummaStealer)
Reporter	SquiblydooBlog
Tags:	exe signed

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

112

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

Oficio_20392302026.exe

Verdict:

Malicious activity

Analysis date:

2026-03-30 20:43:54 UTC

Tags:

auto-reg delphi inno installer nodejs

Link:

https://app.any.run/tasks/d01dc06b-270c-4d61-acfe-e3f60fdbfba5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CyberFortress Clean

Verdict:

Clean

Score:

50.0%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cadfc83a18a6e1ddefd975

Tags:

n/a

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Creating a file in the %AppData% directory

DNS request

Connection attempt

Sending a custom TCP request

Unauthorized injection to a recently created process

Loading a suspicious library

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

adaptive-context anti-debug embarcadero_delphi fingerprint inno installer installer installer-heuristic packed short-lived-cert signed soft-404

Link:

https://www.filescan.io/uploads/69cadfbe2346b9da57b18608/reports/872614f8-2ee6-40e8-89bf-0a24a15e896f/overview

Hybrid Analysis Trojan.Generic

Verdict:

Suspicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-03-30T17:48:00Z UTC

Last seen:

2026-04-01T12:16:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.APosT.bmfr Trojan.APosT.UDP.C&C

Link:

https://opentip.kaspersky.com/d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a/results?tab=lookup

Nucleon Malprob Susipicious

Score:

53%

Verdict:

Susipicious

File Type:

PE

Link:

https://malprob.io/report/d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a

CERT.PL MWDB

Gathering data

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/d418420aa4accfb887be12a22b277a1ea14a74bbb074debd1dc2cd341117ec1a

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-30 20:40:42 UTC

File Type:

PE (Exe)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2qmeecvevth3rb56ckrcwj32d2quu5f3wb2n5pi5ylgtieix5qna._file

Threatray shellcode_loader_008

Verdict:

malicious

Label(s):

shellcode_loader_008

Alert

Create hunting rule

Similar samples:

error

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery installer persistence

Link:

https://tria.ge/reports/260330-zf4thsbt3z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.