🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Adware.OfferCore


Vendor detections: 15


Intelligence 15 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b
SHA3-384 hash: b17594fad1b1fbdaab79a9a894f958c58b6826aed6c34fc5aab016983b22a56b005e134e7ac67867ff222534e11edd8a
SHA1 hash: 0ea8637cab0ef3e0c5c58b55bb1d917055867ff8
MD5 hash: ec4c2db69ea4ea123f80fec06431f50a
humanhash: thirteen-dakota-stream-iowa
File name:fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b.exe
Download: download sample
Signature Adware.OfferCore
Create hunting rule
File size:2'132'400 bytes
First seen:2026-11-13 00:22:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (33 x Adware.OfferCore, 32 x ValleyRAT, 23 x Tofsee)
ssdeep 24576:eXNrSLScusMmOvjjhzvL5qtRgkcXjPeynRkIegf+Sve+9Cx+gBbfWzOUxSXc64de:BuI2hkHcTeynRkfg7ve+AhrWzOUA
TLSH T199A5D03FB28B653EE06E5A3A7A72E210583B7A6165164C4696F4C88CCF254701E3F787
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon b36494a8cca2cc4d (22 x Adware.OfferCore, 6 x RedLineStealer, 1 x RaccoonStealer)
Reporter Tuxxin
Tags:Adware.OfferCore exe signed

Code Signing Certificate

Organisation:SOFTONIC INTERNATIONAL SA
Issuer:Sectigo Public Code Signing CA EV R36
Algorithm:sha256WithRSAEncryption
Valid from:2026-01-28T00:00:00Z
Valid to:2027-01-28T23:59:59Z
Serial number: c3607b2510e7ab39ff16c1998bbf0c85
Intelligence: 20 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: b1e1dbb1624601638e698d1bf0c4e080eb335e6fb4dd29df68ab6951a96452e7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ae2f2efc-b197-42c4-866f-2e73e9cd4b84/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-13 00:37:45 UTC
Tags:
installer delphi inno
Link:
https://app.any.run/tasks/dfd16b29-942d-4523-a27a-e7f61c83afaf

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99723/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af6587883200b505eda55e8
Tags:
injection softonic virus core
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Creating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug crypto embarcadero_delphi evasive fingerprint inno installer installer installer-heuristic packed reconnaissance signed
Link:
https://www.filescan.io/uploads/6af65871b9f77c2346e4132d/reports/e256faa6-9287-4a81-bcc3-26dc5e7be4df/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b
Verdict:
Adware
File Type:
exe x32
Link:
https://opentip.kaspersky.com/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b857a57e-41e0-425a-ae33-7debc03838b6
Result
Threat name:
n/a
Detection:
malicious
Classification:
rans.troj.evad
Score:
46 / 100
Link:
https://www.joesandbox.com/analysis/2005072
Signature
Contains functionality to infect the boot sector
Creates a FSFilter Anti-Virus service
Creates an undocumented autostart registry key
Creates HTML files with .exe extension (expired dropper behavior)
Creates multiple autostart registry keys
Detected potential unwanted application
Enables network access during safeboot for specific services
Installs a global event hook (focus changed)
Multi AV Scanner detection for submitted file
NDIS Filter Driver detected (likely used to intercept and sniff network traffic)
Tries to detect sandboxes / dynamic malware analysis system (Installed program check)
Writes many files with high entropy
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2005072 Sample: seoPD6CfWm.exe Startdate: 13/11/2026 Architecture: WINDOWS Score: 46 179 v7event.stats.avast.com 2->179 181 honzik.avcdn.net 2->181 183 33 other IPs or domains 2->183 211 Multi AV Scanner detection for submitted file 2->211 213 Detected potential unwanted application 2->213 215 NDIS Filter Driver detected (likely used to intercept and sniff network traffic) 2->215 13 seoPD6CfWm.exe 2 2->13         started        16 svchost.exe 2->16         started        18 svchost.exe 2->18         started        20 6 other processes 2->20 signatures3 process4 file5 161 C:\Users\user\AppData\...\seoPD6CfWm.tmp, PE32 13->161 dropped 22 seoPD6CfWm.tmp 6 35 13->22         started        27 WerFault.exe 16->27         started        29 WerFault.exe 16->29         started        process6 dnsIp7 191 swls.map.fastly.net 151.101.1.91, 443, 49728, 49729 FASTLY-FastlyIncUS Canada 22->191 135 C:\...\avast_free_antivirus_setup_online.exe, PE32 22->135 dropped 137 C:\Users\user~1\AppData\...\component0 (copy), Zip 22->137 dropped 139 C:\Users\user\AppData\...\OperaSetup.exe, PE32 22->139 dropped 141 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 22->141 dropped 233 Creates HTML files with .exe extension (expired dropper behavior) 22->233 235 Writes many files with high entropy 22->235 237 Tries to detect sandboxes / dynamic malware analysis system (Installed program check) 22->237 31 avast_free_antivirus_setup_online.exe 1 2 22->31         started        36 OperaSetup.exe 2 22->36         started        38 chrome.exe 22->38         started        40 2 other processes 22->40 file8 signatures9 process10 dnsIp11 207 e337078.dscd.akamaiedge.net 23.201.34.134, 443, 49738, 49744 AKAMAI-ASN1NL United States 31->207 95 C:\...\avast_free_antivirus_online_setup.exe, PE32 31->95 dropped 209 Contains functionality to infect the boot sector 31->209 42 avast_free_antivirus_online_setup.exe 6 46 31->42         started        97 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 36->97 dropped 46 installer.exe 82 36->46         started        49 chrome.exe 38->49         started        51 chrome.exe 38->51         started        file12 signatures13 process14 dnsIp15 143 C:\Windows\Temp\...\icarus.exe, PE32+ 42->143 dropped 145 C:\Windows\Temp\...\setupui.cont, XZ 42->145 dropped 147 C:\...\c685fcf7-bec1-4fbd-b542-f932ea127b82, LZMA 42->147 dropped 157 9 other files (5 malicious) 42->157 dropped 239 Writes many files with high entropy 42->239 53 icarus.exe 42->53         started        193 api.config.opr.gg.cdn.cloudflare.net 104.18.24.17, 443, 49838 CLOUDFLARENET-CloudflareIncUS Canada 46->193 195 e125010.dscd.akamaiedge.net 23.201.34.143, 443, 49851 AKAMAI-ASN1NL United States 46->195 149 C:\Users\user\AppData\Local\...\opera_package, PE32 46->149 dropped 151 de932af914ba00303d...831101e2.crx (copy), Google 46->151 dropped 153 Assistant_136.0.60....exe_sfx.exe (copy), PE32 46->153 dropped 159 2 other files (none is malicious) 46->159 dropped 58 installer.exe 46->58         started        60 Assistant_136.0.6008.52_Setup.exe_sfx.exe 46->60         started        62 assistant_installer.exe 46->62         started        64 2 other processes 46->64 197 ssbsync.smartadserver.com 49->197 199 ssb-global.smartadserver.com 49->199 201 180 other IPs or domains 49->201 155 Chrome Cache Entry: 2065, PDP-11 49->155 dropped file16 signatures17 process18 dnsIp19 185 8.8.8.8 GOOGLE-GoogleLLCUS United States 53->185 187 34.160.176.28 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 53->187 189 23.201.34.135 AKAMAI-ASN1NL United States 53->189 117 C:\Windows\Temp\...\icarus_rvrt.exe, PE32+ 53->117 dropped 119 C:\Windows\Temp\...\icarus_product.dll, PE32+ 53->119 dropped 121 C:\Windows\Temp\...\icarus.exe, PE32+ 53->121 dropped 129 13 other files (8 malicious) 53->129 dropped 231 Writes many files with high entropy 53->231 66 icarus.exe 53->66         started        70 icarus.exe 53->70         started        123 C:\Users\user\AppData\Local\...\installer.exe, PE32+ 58->123 dropped 125 C:\Users\user\AppData\...\wave-light.zip, Zip 58->125 dropped 131 30 other files (13 malicious) 58->131 dropped 72 installer.exe 58->72         started        74 installer.exe 58->74         started        127 C:\Users\user\...\assistant_installer.exe, PE32 60->127 dropped 133 3 other files (none is malicious) 60->133 dropped 76 assistant_installer.exe 62->76         started        file20 signatures21 process22 file23 99 C:\...\snxhk.dll.ipending.3140c421, PE32 66->99 dropped 101 vcruntime140_threa...l.ipending.3140c421, PE32 66->101 dropped 103 C:\...\vcruntime140.dll.ipending.3140c421, PE32 66->103 dropped 111 824 other files (489 malicious) 66->111 dropped 217 Creates an undocumented autostart registry key 66->217 219 Creates multiple autostart registry keys 66->219 221 Enables network access during safeboot for specific services 66->221 223 Creates a FSFilter Anti-Virus service 66->223 78 AvEmUpdate.exe 66->78         started        82 AvEmUpdate.exe 66->82         started        105 C:\...\uiext.dll.ipending.946038e6, PE32+ 70->105 dropped 107 C:\...\swhealthex2.dll.ipending.946038e6, PE32+ 70->107 dropped 109 C:\...\protobuf.dll.ipending.946038e6, PE32+ 70->109 dropped 113 170 other files (135 malicious) 70->113 dropped 225 Writes many files with high entropy 70->225 84 engsup.exe 70->84         started        115 3 other files (none is malicious) 72->115 dropped 227 Installs a global event hook (focus changed) 72->227 86 assistant_installer.exe 72->86         started        89 installer.exe 72->89         started        signatures24 process25 dnsIp26 203 23.210.73.88 AKAMAI-ASN1NL United States 78->203 205 23.210.92.234 AKAMAI-ASN1NL United States 78->205 163 C:\Program Files\Avast Software\...\aswSP.sys, PE32+ 78->163 dropped 165 C:\...\aswSP.sys.179453297565604 (copy), PE32+ 78->165 dropped 167 C:\Windows\System32\drivers\aswSP.sys, PE32+ 78->167 dropped 177 2 other files (none is malicious) 78->177 dropped 169 C:\Users\user\AppData\Local\...\dbghelp.dll, PE32 86->169 dropped 171 C:\Users\user\AppData\Local\...\dbgcore.dll, PE32 86->171 dropped 173 C:\Users\user\...\browser_assistant.exe, PE32 86->173 dropped 175 C:\Users\user\...\assistant_installer.exe, PE32 86->175 dropped 229 Creates multiple autostart registry keys 86->229 91 assistant_installer.exe 86->91         started        93 assistant_installer.exe 86->93         started        file27 signatures28 process29
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/ec4c2db69ea4ea123f80fec06431f50a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b/
Threat name:
Win32.PUA.OfferCore
Create hunting rule
Status:
Suspicious
First seen:
2026-11-12 17:12:37 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
13 of 36 (36.11%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7wxjk37m7urejcyhdhtg3dwwng22z5jnzjchf2cj3hyuduic7zvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/261113-aphvzad19z/
Behaviour
Checks processor information in registry
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Checks for any installed AV software in registry
Checks installed software on the system
Executes dropped EXE
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
win_token
Link:
https://app.threat.zone/submission/02e563fa-dcd6-40c2-bfd4-a3f974c9ee54
Malware Family:
offercore
Create hunting rule
Malicious:
True
Tags:
file-overlay signed exe
Link:
https://intel.virussign.com/intelligence/file/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b
Unpacked files
SH256 hash:
fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b
MD5 hash:
ec4c2db69ea4ea123f80fec06431f50a
SHA1 hash:
0ea8637cab0ef3e0c5c58b55bb1d917055867ff8
Link:
https://www.unpac.me/results/a0b5bb16-324e-49af-8ad7-96fff3bc755e/
SH256 hash:
560cb50c25989eb270d2f60acaa76cdddf1dff74f38a683511c07aab9ba7f0c3
MD5 hash:
381b31cfa2084aca666f203f8eca3b0f
SHA1 hash:
4566fb3090c4060b1239ddcb3868b3cc5ea7a6c0
Link:
https://www.unpac.me/results/a0b5bb16-324e-49af-8ad7-96fff3bc755e/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/a0b5bb16-324e-49af-8ad7-96fff3bc755e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Adware.OfferCore

Executable exe fdae956fecfd22448b0719e66d8ed669b5acf52dca4472e849d9f141d102fe6b

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/99723/

Comments