MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daa9a1dc5ea944b0912e335daed7c60d4048ee15c844f1fb7fdd00925698a02c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	daa9a1dc5ea944b0912e335daed7c60d4048ee15c844f1fb7fdd00925698a02c
SHA3-384 hash:	79413c5801627b679c7976dbfd0096e2ed79ae74a8899654119cdffd38bb7ee26068dc9b2bafbfe686d8e21083d829a5
SHA1 hash:	1adb76e73ff07ab58ff915044fbeb015217b9758
MD5 hash:	3e22dc12ac0e58e4c4fa4491d6ac5b4d
humanhash:	august-india-lake-king
File name:	p2.bat
Download:	download sample
File size:	951 bytes
First seen:	2026-11-14 06:56:13 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	12:wLDOkrQzaj5mHBVPElxrjWbYCjKrPEb9NWxEJg3QVb5PEy6g3UPCIWsiDe0C2:wLDIzDLPernPFJ3Q3P93UP/diDh
TLSH	T14811BDDF7C0B9AF4CB060A4AE55D8148A112E22F6B006F38CAF810D7EC60A963D3CE54
Magika	batch
Reporter	Latin

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

14

Origin country :

US

Vendor Threat Intelligence

ACCE BatchScript_FileType

Malware configuration found for:

BatchScript

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4a436563-42f1-40fb-9fb3-0d3d0ecc1e16/

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

bat

Verdict:

Malicious activity

Analysis date:

2026-11-14 07:40:28 UTC

Tags:

auto-sch

Link:

https://app.any.run/tasks/7b91b4a4-93ea-43ce-9245-d1c81fbe7df0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/99993/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af8062683200b505eda871a

Tags:

obfuscate autorun shell sage

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/daa9a1dc5ea944b0912e335daed7c60d4048ee15c844f1fb7fdd00925698a02c

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/2005872

Signature

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: Suspicious New Service Creation

Uses schtasks.exe or at.exe to add and modify task schedules

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/daa9a1dc5ea944b0912e335daed7c60d4048ee15c844f1fb7fdd00925698a02c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/daa9a1dc5ea944b0912e335daed7c60d4048ee15c844f1fb7fdd00925698a02c/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ku2dxc6vfclbejogno25v6gbvaer3qvzbcpd6373uajevuyuawa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

execution persistence

Link:

https://tria.ge/reports/261114-hqlbgsbw6l/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Executes a command shell one-liner

Launches sc.exe

Creates new service(s)

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/99993/