845b30ffa7cd1180517aad6d3c0c653e0e4e49b5bfe34d7e692a76752d63d57c

Classification: Malicious

845b30ffa7cd1180517aad6d3c0c653e0e4e49b5bfe34d7e692a76752d63d57c is a malicious file sample. Reported by 2 threat sources, last seen 2026-09-02.

Detection summary

  • 29 antivirus detections
  • 0 IDS alerts
  • 5 processes observed
  • 1 contacted hosts
  • 0 DNS requests

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Generic Malware Hybrid-Analysis 2024-09-22 04:15:03 2026-09-02 21:45:08 malicious-activity
Generic.Malware MalwareBazaar Abuse.ch 2024-09-22 03:58:01 2024-09-22 03:58:01 malicious-activity

Tags

evasive

Sample information

Filenames
845b30ffa7cd1180517aad6d3c0c653e0e4e49b5bfe34d7e692a76752d63d57c, BallonySwords.exe
File type
PE32 executable (console) Intel 80386 Mono/.Net as ...
Size
475512 bytes
MD5
f1def597850e7f0490adc3a10b08db3d
SHA-1
3dd5594049e154002f3b60c821a4d8d854d212c6
SHA-256
845b30ffa7cd1180517aad6d3c0c653e0e4e49b5bfe34d7e692a76752d63d57c
First indexed
2024-09-22 03:59:38
Last updated
2026-09-02 21:45:08

Antivirus detections

EngineDetection
ALYacGen:Variant.MSILHeracles.179443
APEXMalicious
AVGWin32:PWSX-gen [Trj]
AhnLab-V3Trojan/Win.Vidar.C5672959
ArcabitTrojan.MSILHeracles.D2BCF3
AvastWin32:PWSX-gen [Trj]
BitDefenderGen:Variant.MSILHeracles.179443
BkavW32.AIDetectMalware.CS
CTXexe.unknown.msilheracles
ClamAVWin.Packed.Pwsx-10035189-0
CrowdStrikewin/malicious_confidence_60% (D)
CylanceUnsafe
DeepInstinctMALICIOUS
ESET-NOD32a variant of MSIL/GenKryptik.HBWY
Elasticmalicious (high confidence)
EmsisoftGen:Variant.MSILHeracles.179443 (B)
FireEyeGeneric.mg.f1def597850e7f04
GDataGen:Variant.MSILHeracles.179443
GoogleDetected
GridinsoftTrojan.Win32.Packed.dd!ni
IkarusTrojan.MSIL.Krypt
MicroWorld-eScanGen:Variant.MSILHeracles.179443
MicrosoftProgram:Win32/Wacapew.C!ml
SentinelOneStatic AI - Malicious PE
SymantecML.Attribute.HighConfidence
Trapminemalicious.moderate.ml.score
VIPREGen:Variant.MSILHeracles.179443
VaristW32/MSIL_Agent.ILW.gen!Eldorado
huorongTrojan/MSIL.Agent.li

Network contacts

185.236.228.12

Process list

NameCommand line
BallonySwords.exe
RegAsm.exe
WerFault.exe-u -p 2876 -s 956
WerFault.exe-u -p 2876 -s 956
WerFault.exe-pss -s 448 -p 2876 -ip 2876