🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5
SHA3-384 hash: 94e815bd33b0b1d8d7b203b6daacfc2b6038a9ba4046efa38e841334cad8dd1b4006d29a5fb15c17f43d480ae14dfa95
SHA1 hash: c3b10a2c498f09fd1c0643f41084ad973f020d52
MD5 hash: a9c0fab8fb0809735d074aa619c0958f
humanhash: bravo-juliet-hamper-pasta
File name:a9c0fab8fb0809735d074aa619c0958f
Download: download sample
File size:8'502'056 bytes
First seen:2026-10-19 06:46:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 817659d4155ea1f078b4ced0ba1f20e9
ssdeep 196608:vOlhlJ0nBjr+3XR1qU1SoisXgLp7iy39Kqh:GhfYJy3HSBsXgRfh
TLSH T159862315F2D78132E1EF42315DA6EB298574BC337522852BBBE0234E5E73A82E536353
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon 6ded69c7b130b2c0 (16 x ValleyRAT, 12 x CryptBot, 8 x NetSupport)
Reporter adrian__luca
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-19 07:18:05 UTC
Tags:
advancedinstaller
Link:
https://app.any.run/tasks/d3bbd93e-90db-4eb3-9b67-b4cca3c73eba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/92591/
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad5bf4e5a22ac805bd7d614
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Gathering data
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5
Verdict:
Unknown
File Type:
exe x32
Link:
https://opentip.kaspersky.com/dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5/results?tab=lookup
Malware family:
FlashForge
Create hunting rule
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0a694969-1db1-40cb-9395-5890b3b07658
Score:
59%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ulibt32x4meg7zngucdb364bsinmbngtpyhtl3a7fixbk7wvxsq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/261019-hke8aa1xev/
Behaviour
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5
MD5 hash:
a9c0fab8fb0809735d074aa619c0958f
SHA1 hash:
c3b10a2c498f09fd1c0643f41084ad973f020d52
Link:
https://www.unpac.me/results/ed1857d7-abec-4ded-8e08-efe1ee30b6cd/
SH256 hash:
562949c7719b550ee90c03e1b04c45693afed5eca4604a5f0ac75d5c35df4ee9
MD5 hash:
54160f89578d7f330623d1b94fe9d7c6
SHA1 hash:
6199dbe112f47426eb374cc0293ab03c7e092e28
Link:
https://www.unpac.me/results/ed1857d7-abec-4ded-8e08-efe1ee30b6cd/
SH256 hash:
537154e8cea49af3a28cfa1c345a24e5cc11baf91ccd7a048651d20686283ed0
MD5 hash:
30ae4055e81b4b238d0227b844577674
SHA1 hash:
c8f91b896c81682bb473a2db1c9b1dfa1e85d2ca
Link:
https://www.unpac.me/results/ed1857d7-abec-4ded-8e08-efe1ee30b6cd/
SH256 hash:
69cd5b34cf3edf623b2a7df927f51c0f34669a410321375d4b682d6a14d1b5b0
MD5 hash:
47d953c6a11948f834ddf5ca8ce4c416
SHA1 hash:
c33d96c29caf386bc4a2211ee9edb5196eae15d2
Link:
https://www.unpac.me/results/ed1857d7-abec-4ded-8e08-efe1ee30b6cd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Havex
Create hunting rule
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_Ceber_ForgeAuto_8b9c7147_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Ceber (pe, etat extrait)
Rule name:WIN_Malware_Cerber_ForgeAuto_b3e1e9d9
Create hunting rule
Author:Marjoriefort
Description:Detects Cerber (pe, etat binaire)
Rule name:WIN_Malware_Fantom_ForgeAuto_98e6f354_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Fantom (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Executable exe dd1680cf7abf18437f2d350430efdc0c90d605a69bf079af60f95170abf6ade5

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/92591/

Comments