MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9
SHA3-384 hash: 79337f4ca43d09197dc1ba6b59ede0e11756bfbf821202e356180640a9cd4da9d1db66a5751bafe03ea7b9d1d788fab1
SHA1 hash: 6fc4e68f7eb29f0d2ef9664b33e1e9956922c534
MD5 hash: 0697f7c6a3b9c4f4c3b62d7dcd28463b
humanhash: jig-eighteen-fix-happy
File name:ID Patcher.exe
Download: download sample
File size:59'392 bytes
First seen:2025-05-17 15:11:36 UTC
Last seen:2025-08-13 20:48:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f4bb4222146d800b890601f425c01f46
ssdeep 1536:4ClnE0uxJv3s1FtmWK6UWsBZsT5ZIC58:tlE0u3v3CtdbUWsHsTcC58
TLSH T1B443D7172B8F5545C3140F3C4A12AA2841AD9C7BF964D20A6AF67BF5FAFF7D1A900036
TrID 28.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
25.5% (.EXE) Win32 Executable (generic) (4504/4/1)
11.6% (.ICL) Windows Icons Library (generic) (2059/9)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon f0c87a5b61b098e8
Reporter Anonymous
Tags:deskiddifier exe


Avatar
Anonymous
Uploaded from Deskiddifier UI

Intelligence

File Origin
# of uploads :
2
# of downloads :
495
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ID Patcher.exe
Verdict:
No threats detected
Analysis date:
2025-01-14 17:45:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/6e3aa672-38a1-4442-b441-b2761a5a7134

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.31989.10842.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6828a74ee5aa44ec2e1a34f1
Tags:
patcher virus
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context masm
Link:
https://www.filescan.io/uploads/6828a752bff72ff46b6592e9/reports/6c72f806-54d6-4364-a7ef-df065b8aec55/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/32884dd3-9882-44c3-8164-0bf1f45c71da
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1598522
Signature
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
80%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9/
Threat name:
Win32.Hacktool.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-12-30 01:12:14 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
18 of 37 (48.65%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2uvogaxq5qmxdwdcceaczbgl6q6xqn6iheq56nnz2ff5ulywgcuq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/250517-slbatshr5w/
Behaviour
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9
MD5 hash:
0697f7c6a3b9c4f4c3b62d7dcd28463b
SHA1 hash:
6fc4e68f7eb29f0d2ef9664b33e1e9956922c534
Link:
https://www.unpac.me/results/73d0b316-00e5-43d3-854f-551dbfa0e0af/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dUP2xPatcherwwwdiablo2oo2cjbnet
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe d52ae302f0ec1971d86211002c84cbf43d7837c83921df35b9d14bda2f1630a9

(this sample)

  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::CreateFileMappingA
kernel32.dll::GetFileAttributesA
kernel32.dll::FindFirstFileA

Comments