MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3
SHA3-384 hash: de09474032102439180da52b29c7b8baa5d00648a5f7a11edfa4ec0484ccc1243834ac9b6852232812d81c78d34f1152
SHA1 hash: fcf5ea212deef518bca704649bd2a07cc43a8e0f
MD5 hash: 2feaa89101045abb826c9761b0d5cd35
humanhash: fifteen-johnny-idaho-berlin
File name:webplugin.exe
Download: download sample
File size:2'219'240 bytes
First seen:2026-03-26 09:04:58 UTC
Last seen:2026-03-26 20:36:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 24576:KNFuyA0n1tXAwFGZOEWcJrHvi/aaBOSd/MugwtUvih6IiuTiF3BMS3QpNvLz4Sfe:nubJcOrzZxgwOid6RMIONvLz4Sflvtqn
TLSH T1B0A533C2C0E9095AD343D334B7C5F6B269FB4B646E9510C717C06D7A60B12EABA10DEE
TrID 93.1% (.EXE) NSIS - Nullsoft Scriptable Install System (846567/2/133)
3.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
0.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
0.7% (.EXE) Win64 Executable (generic) (6522/11/2)
0.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon 104ca2f0e8cce871
Reporter juroots
Tags:exe signed

Code Signing Certificate

Organisation:Zhejiang Dahua Technology CO.,LTD.
Issuer:GlobalSign CodeSigning CA - G3
Algorithm:sha1WithRSAEncryption
Valid from:2017-08-16T05:48:50Z
Valid to:2020-08-01T05:33:51Z
Serial number: 13024f8080b9b2ebc6caf9d9
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 0cfc856d7dc2d0d14b0fff07614ea8a1ae8ba0d65047f2908be26dd123842a3d
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
4
# of downloads :
107
Origin country :
CH CH
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
NSIS
extracted archive contents
Link:
https://research.acce.ciphertechsolutions.com/results/ce01867b-7269-442d-852a-15ba65adbab4/
Malware family:
n/a
ID:
1
File name:
7b77f439_tmp.exe
Verdict:
Suspicious activity
Analysis date:
2026-03-26 09:05:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/40e4c003-10ff-41a4-a001-8868d798c231

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
PUA.Win.Trojan.Casino-141
Create hunting rule

Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69c4f6ddaacb4c376b142bae
Tags:
injection obfusc madi sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Creating a file in the %temp% directory
Creating a window
Creating a file
Searching for the window
Searching for the Windows task manager window
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Launching a process
Creating a file in the %AppData% subdirectories
Launching a tool to kill processes
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug blackhole expired-cert installer installer installer-heuristic microsoft_visual_cc nsis packed signed soft-404
Link:
https://www.filescan.io/uploads/69c4f6ff2346b9da57a7fc19/reports/2039c37a-afe3-4ec1-8b32-563af63cf571/overview
Verdict:
Malicious
Labled as:
Win/grayware_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3
Verdict:
Clean
File Type:
PE
First seen:
2019-02-15T13:16:00Z UTC
Last seen:
2026-02-13T13:27:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9a58cbf2-2dd7-40b0-99f3-6c4f44152e05
Score:
29%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xy4hyxdi56z6pddbqyvzjii7bcy7i7ogpl6nzadqnrgxdurmhrq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery installer
Link:
https://tria.ge/reports/260326-k2nbbsew5w/
Behaviour
Kills process with taskkill
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Executes dropped EXE
Loads dropped DLL
Unpacked files
SH256 hash:
d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3
MD5 hash:
2feaa89101045abb826c9761b0d5cd35
SHA1 hash:
fcf5ea212deef518bca704649bd2a07cc43a8e0f
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
a56a8ce02fd483abac5465710439e5de167c4be11bf0606c1696c0851386cad3
MD5 hash:
a5b65d2991f97641c15ec8ca28acfebb
SHA1 hash:
03544abd6dce0d62aecbc16c4854768dd4903ff8
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
8d2915506c1694ed94d420528292bf4ffff3af6f44cc988c39197107fb57942e
MD5 hash:
f7e596922433243a6e7ef8a370271354
SHA1 hash:
0adbf5c188b2568b8e0ab4cf3337749970570cd9
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
920133abd99a7b0c1f5da95d7e109f707e8d75d16861c449e66ebb192ec9c892
MD5 hash:
fec4410e4f8f45f4032b33db1e3f4bec
SHA1 hash:
2089e8ec80512b4e7548938501e9fcc488a99146
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 hash:
325b008aec81e5aaa57096f05d4212b5
SHA1 hash:
27a2d89747a20305b6518438eff5b9f57f7df5c3
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
3a25b7efd62c9fcdcb27c385e8aa43e00a75737431a253aff73823e26bdba676
MD5 hash:
f5d091aaaa41b7033e5c5c48a1ae1653
SHA1 hash:
2f7aa614c129a3d00d9cb563a09d5012ff773f74
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
5d7e0fb71ed7320c66b004bf1ac330a77867b1d1063b32fdd362c9be08a143a0
MD5 hash:
5485ab8fd23a9052da7fdda1ea83bf4b
SHA1 hash:
54d850d93235c98b6fee38bcbce46245267b8f1d
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
1cbc153b16fa9305a6fb381555beb18892d9cbb05caa90819966176c7a5935ec
MD5 hash:
e928dd0a01020ded3e5348e4be19fd48
SHA1 hash:
6593c9d9bf571012440e0dc5a3ca4f5f8a0902f5
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
f170d6eb54eda65fa651717333051be6461ef8ed54f94f1e5e234307c923037f
MD5 hash:
2eda8d145184caf66adc8b87894d2eaf
SHA1 hash:
7022fab4b9cb054490ea204c249a0857356a9efe
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
5c4916e372cd146159305135852854135affc89c510286d635648e32c7ff7659
MD5 hash:
02500b6f95fe46f25a444fb696a00826
SHA1 hash:
793695a2e9d174afb70da540ab50a32d76f44769
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
331280a0370e8d2e37e7cdbc6e2f1d4c51c8b8e792e2af62de8434ee6d960374
MD5 hash:
ccde0f67ddd9f1f6ed69d2c4437e0bbc
SHA1 hash:
83b45ef859211dd4d0a41425de349cbae423e2f4
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
b5706a763a5da75cbc5c2feeece01ccfe7d375039afa152aa5de596bd24340c4
MD5 hash:
59bc6744a15cf842b24afe4944cfd19d
SHA1 hash:
907f3fe9524cd298ca7c4257e266f395b7487308
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
f2e545bce83144f48c5ceaa341884103c488b8854954a0f875d638ebcdfd48f4
MD5 hash:
6c2ed9e4a6baffd1e6a7869ab5c40cf3
SHA1 hash:
a388ab2a4e27b95acaa48e0bf1ad283c609a5ea3
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
9e4fd83eb7a08ee043bf5750e74222b1ff295f856b40da21b219b0ba08d0590d
MD5 hash:
0c8e7d8a7088982d8774a220cf85bd14
SHA1 hash:
a4f56f0a49d5323f7c78c9f7e49c762d18c5d2f8
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
999e2cd4e65264911a5926356406cf934a2ee3bd4b1675a6229f6ba0b554c344
MD5 hash:
6c8cfcdc1956b76108253cb1644fbf67
SHA1 hash:
bf5534f5760444d79f6c5c40e5c8d9297615d1b9
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
672f846c7abe54e14665f8e4ae5c7c4108ee6975bf614363a00d6bab7cca71e7
MD5 hash:
a2acf6510b38c43fc27942e10206e9cb
SHA1 hash:
bfa059f93f1b99a50bbc64696489473f25af0343
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
26950d6c3913f7a2041f54e856ffa3c11c0da1a97feaa17cb0f7f8d0c2ea8b13
MD5 hash:
4a284bf94daf63ce7e337cea422fa658
SHA1 hash:
ce47f8ef76498a5ce6e25e58588f5568a45c9195
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
765e1836fb71b9a3b6988b34b635eb6e9be24bacafa9c656477d91acf93a664a
MD5 hash:
117bcef85c00b55a4935d4eb8b58ee3a
SHA1 hash:
d24b53101a8feb49d309efd2252c1185653564fe
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 hash:
acc2b699edfea5bf5aae45aba3a41e96
SHA1 hash:
d2accf4d494e43ceb2cff69abe4dd17147d29cc2
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
5a8f0c81442655f0cebaf6491315fd830dc61936e0928ee3a3d1e86b79354146
MD5 hash:
37de24a0c78b0cb8660d6a18f0df0915
SHA1 hash:
e72499a36ffa3c53886fc20679eacc0ff62345fa
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
c6383ff7f0b16f8f7594402674dcb7696846a32f002e1de2df7a74f56110ffaa
MD5 hash:
f1be40eed79c3f3ddbf29875e66f5d5e
SHA1 hash:
e819d3dadcb03b6a1c2a0ae6a86d2601e997b9a8
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
2dfa432ae2b9a3d5a77b122047673fdbbd087f3db63fb10ad5511ae10ca59cf9
MD5 hash:
e73400d69f31c4179d0783bfefc4cfd1
SHA1 hash:
e84954db54eab906d37b8e80a98ee25d705c8e9f
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
cae413b197a5dcc6fb7fdc130d04ada7bd6ec3bc93c6ac3802dbe2f2776494c4
MD5 hash:
7960e6d4117b78f9149574f062bf7d2a
SHA1 hash:
e9c094c78b2f217f9001441caa640c8c1adaba65
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
412e5d10b782c6753732dfa6ff0a5e10bbda93326a8a280b652a665ffeec1059
MD5 hash:
ee8a6e3c23eae1ae97a4ea296997e574
SHA1 hash:
ea04beba34b0dc6a371b2cbd7b9e4e25fc136069
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
7e2e8fc2d50f3711ddbc96ef954df1e125b630fb16dd2ea24b45cbb6de87bd66
MD5 hash:
eaa7600d4fab4d7291451d39816f197d
SHA1 hash:
f3a5422efbce2d12a52055b293b887143f123ef9
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
1345ef96fec8f28c08560bc022ac5c492937e65ebd4717de6a0670d143090ba3
MD5 hash:
8591c76fc3df230da89a8ab0cae9b1f4
SHA1 hash:
f66e1ac0837277760d60efdf79441a8a3e844cc6
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
SH256 hash:
af0145b5e64719418528dc3f5b163fb426804899018a3096dc11f6aed0f7836d
MD5 hash:
afe4daec4b6b79ae87c3d2685b97e64a
SHA1 hash:
fc393c32a6d960751900a05a8663b1066860f5d3
Link:
https://www.unpac.me/results/7a0f11e7-8b44-4cec-b2ea-66ec1055fa3b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_SliverFox_String
Create hunting rule
Author:huoji
Description:Detect files is `SliverFox` malware
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe d5f1c3e2e3477d9f3c630c315ca508f8458fa3ee33d7e6e40383626b8e9161e3

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/59345/
  
URLhaus
https://urlhaus.abuse.ch/url/3805591/
  
Delivery method
Distributed via web download

Comments