🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f3cb3b3f189711cb13c89f0660fbf19f92d92d02dc817d4e3a60b709bbca2ffa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 11 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f3cb3b3f189711cb13c89f0660fbf19f92d92d02dc817d4e3a60b709bbca2ffa
SHA3-384 hash: ae97ca38732dd9a47ac154c4fa439384d45239e0ae8bfa51a10a7234febb018d0e51d7eb23411aa09f914d32e752fa74
SHA1 hash: 3386a0f22b553a7f62144725170a349ce8f36f23
MD5 hash: 2d2976608a515722a98f9ae62d08d19f
humanhash: jersey-quiet-artist-equal
File name:PDF_789395.exe
Download: download sample
File size:30'814'744 bytes
First seen:2026-11-12 11:01:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 5a594319a0d69dbc452e748bcf05892e (32 x Gh0stRAT, 21 x ParallaxRAT, 16 x ValleyRAT)
ssdeep 786432:/YtGOKTuVdd9GScgO6t2yEWZ8j52TI9JdI43OCDHeiXU:/MyyztVIj52YJ3OM+ik
TLSH T15967337BB258A13EC86E1F3356B3E2206C777656B82A8C1E03E0454ECF651B01F7BA55
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon deb17964d4696996
Reporter ni_fi_701
Tags:exe signed

Code Signing Certificate

Organisation:Serve-o-lution LLC
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-03-23T00:00:00Z
Valid to:2027-03-23T23:59:59Z
Serial number: 0dabb775277835052bc6e8ebba835ab1
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: fa67f4a1603accafa25f7e3d7a2502fb7ccd7909633bf6dafbc56aae04b1b9ce
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
AT AT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e2c73083-213c-4151-843a-c77a5656223f/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af59cc8ed14d027dfb5622c
Tags:
ransomware injection extens
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Creating synchronization primitives
Searching for synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Moving a file to the %temp% subdirectory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug embarcadero_delphi evasive fingerprint inno installer installer installer-heuristic packed reconnaissance
Link:
https://www.filescan.io/uploads/6af59cbd14df734513a337a5/reports/d99a9ce1-20f6-4ddb-9c7d-af75340a02a7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f3cb3b3f189711cb13c89f0660fbf19f92d92d02dc817d4e3a60b709bbca2ffa
Result
Threat name:
n/a
Detection:
suspicious
Classification:
evad
Score:
24 / 100
Link:
https://www.joesandbox.com/analysis/2004650
Signature
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2004650 Sample: PDF_789395.exe Startdate: 12/11/2026 Architecture: WINDOWS Score: 24 42 softwareinnosetup.com 2->42 44 m365adminportal.anc.tm.svc.cloud.microsoft 2->44 46 2 other IPs or domains 2->46 58 Initial sample is a PE file and has a suspicious name 2->58 10 PDF_789395.exe 2 2->10         started        signatures3 process4 file5 32 C:\Users\user\AppData\...\PDF_789395.tmp, PE32 10->32 dropped 13 PDF_789395.tmp 30 427 10->13         started        process6 dnsIp7 56 softwareinnosetup.com 104.26.3.141, 443, 49702 CLOUDFLARENET-CloudflareIncUS Canada 13->56 34 C:\Users\user\AppData\Local\Temp\...\is7z.dll, PE32 13->34 dropped 36 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 13->36 dropped 38 C:\Users\user\AppData\Local\...\is-GLCJN.tmp, PE32 13->38 dropped 40 619 other files (none is malicious) 13->40 dropped 60 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 13->60 18 CoolPDF.App.exe 12 13->18         started        file8 signatures9 process10 process11 20 chrome.exe 10 18->20         started        dnsIp12 48 192.168.2.9, 138, 443, 49258 unknown unknown 20->48 28 C:\Users\...\Unconfirmed 887762.crdownload, PE32 20->28 dropped 24 chrome.exe 20->24         started        file13 process14 dnsIp15 50 s-part-0012.t-0009.t-msedge.net 13.107.246.40, 443, 49728, 49750 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 24->50 52 150.171.109.113, 443, 49765 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS South Africa 24->52 54 40 other IPs or domains 24->54 30 Chrome Cache Entry: 476, PDP-11 24->30 dropped file16
Score:
27%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f3cb3b3f189711cb13c89f0660fbf19f92d92d02dc817d4e3a60b709bbca2ffa
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6pftwpyys4i4we6it4dgb67rt6jnslic3sax2tr2mc3qto6kf75a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/261112-m49y8aeg66/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
win_token
Link:
https://app.threat.zone/submission/cff95a38-c3f5-4403-8a81-f3aff998dad5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f3cb3b3f189711cb13c89f0660fbf19f92d92d02dc817d4e3a60b709bbca2ffa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments


Avatar
NI@FI@701 commented on 2026-11-12 11:07:09 UTC

TamperedChef