MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c
SHA3-384 hash:	51d9ecce68bec92497e81abd327b7fc08f428657c189037baac6938b76c5a59e848013a60da7e03fdfb830476ff16cae
SHA1 hash:	4f4b7db1c2138a91e50a887183c72d099beb3f92
MD5 hash:	6eb57984693009e05dcd0db8a71325b0
humanhash:	massachusetts-bluebird-maine-mexico
File name:	file
Download:	download sample
File size:	67'601'522 bytes
First seen:	2026-08-08 11:51:00 UTC
Last seen:	2026-08-08 18:06:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	70d2e884fa127843c5bcbb53da86b6c8 (9 x TrustConnect, 3 x SoftConnect, 3 x AxisControl)
ssdeep	393216:z115ar3gQhA5GnUORD49O4lZfoYrb1Hxglb/vE5L5OtsFtHNTac9d44scJPJ0ugg:wDJUOl49x71HCUV5OtsFdtaCs4t
TLSH	T175E7AF15B3D80A06E63FC27DC6638112E7F1B4931352D6CF0558EA992F53BC1AB3B266
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-gcleaner exe f MIX4.file

Bitsight

url: http://91.92.242.236/service

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

144

Origin country :

US

Vendor Threat Intelligence

ACCE DotNET_ReadyToRun

Details

Link:

https://research.acce.ciphertechsolutions.com/results/5b7f5200-db91-446b-8542-3fd03bd0938b/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-08 11:54:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2872f72a-ca71-43ad-a613-cad2b7823a17

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Launching a process

Launching a service

Using the Windows Management Instrumentation requests

Moving a recently created file

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug base64 fingerprint microsoft_visual_cc overlay packed privilege reconnaissance reconnaissance

Link:

https://www.filescan.io/uploads/6a77184da2c0057a421fc79c/reports/0eafb675-9263-4e18-a324-b7a6d61c7202/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/f31e99405a3dd500e6845859daf9e5bc1d97e31b8d21cf9043cd1a963372a76c

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6mpjsqc2hxkqbzuelbm5v6pfxqozpyy3ruq47ecdzunjmm3su5wa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion execution persistence privilege_escalation

Link:

https://tria.ge/reports/260808-n1hk8szxgy/

Behaviour

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Adds Run key to start application

Obfuscated Files or Information: Command Obfuscation

Creates a file in the Startup directory

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.