Is Slaves of Nautica_K1y-cf2.exe safe?
Newly submitted 16 MB signed installer with six tier-1 detections naming OfferCore bundler and a signer whose entire history is malicious.
21 of 75 engines flag the file, six of them tier-1, all pointing to the OfferCore/Bundler family. The signer 'Infivora' has a 4/4 malicious track record, and four prior imphash matches were also classified malicious.
9f88972dac4a2ac777…32d61b43bf2234Recommended next actions
Before running
Do not run it. Delete this file from the device, then empty the Recycle Bin or Trash.
If you already ran it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
21 of 75 engines flag the file, six of them tier-1, all pointing to the OfferCore/Bundler family. The signer 'Infivora' has a 4/4 malicious track record, and four prior imphash matches were also classified malicious.
The combination of tier-1 consensus on a named PUP family, a signer with exclusively malicious history, and multiple matching imphashes previously labeled malicious outweighs the absence of known-bad contacted hosts. Sandbox evidence of process injection and LSASS access further supports the malicious classification despite the file's recent first-seen date.
What We Detected
21 of 75 engines report the sample malicious, six of them tier-1 (BitDefender, DrWeb, Emsisoft, ESET-NOD32, Fortinet, GData, Kaspersky, Microsoft). Labels converge on OfferCore/Bundler variants. The executable is signed by 'Infivora', a publisher whose four prior samples were all flagged malicious.
Threat Behavior
Sandbox execution recorded MITRE T1055 process injection and LSASS memory access. The binary contacted 16 external IP addresses directly and wrote multiple temporary installer files. No malicious child binaries or known-bad hosts were confirmed in the available data.
What To Do Now
Do not execute the file. Keep endpoint protection enabled and delete the sample. If the file was downloaded from a third-party source, scan the entire system and review recently installed programs for additional OfferCore components.
Where this verdict could be wrong2 caveats
- contactedHosts.inspected=12 with 0 maliciousHosts — no known-bad infrastructure confirmed
- droppedChildren.hasMaliciousChild=false — no malicious child binaries observed
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No malicious child binaries detected
- no complete contacted-host reputation result was available in cache
- Signer 'Infivora' has 100% malicious history (4/4)
- Six tier-1 engines flag OfferCore/Bundler family
- Sandbox observed process injection (T1055) and LSASS access
- File is rare_new (0 days old, 3 submitters)
Treat as malicious OfferCore bundler; remove the file and scan the system with up-to-date protection.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete21 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial12 of 28 contacted hosts were cross-checked; coverage is incomplete.
YARA
Complete3 signature or behavior rules matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 8MITRE ATT&CK techniques
- 13spawned processes
- 36network contacts
- 6filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Removed execution artefacts or logs, which can conceal activity.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Note: Reads your Windows user-account details.
Note: Collects details about your system.
Note: Loads extra code modules while running.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How bundlers & adware work
This is a bundler — a real-looking installer that hides extra software inside. When you run it, it quietly installs things you never asked for: ad injectors, browser toolbars, fake 'PC cleaner' apps, or even more bundlers. The people behind it get paid for every unwanted app they sneak on.
Bottom line:It's not usually built to destroy files, but it slows your PC, floods it with ads, and can be a real pain to fully remove.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
Slaves of Nautica_K1y-cf2.exe
9f88972dac4a2ac777f899a4ae70fc5ac246c142f50267187932d61b43bf2234
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\executable.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\is-S0NSRTQ6HC.tmp\executable.tmp" /SL5="$5002A,14880881,843264,C:\Users\<USER>\Desktop\executable.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
executable.tmp
C:\Users\<USER>\AppData\Local\Temp\is-S0NSRTQ6HC.tmp\executable.tmp
04Isolated runtime analysis - Written fileObserved
Slime Rancher 2_C2Tl-n7.tmp
C:\Users\<USER>\AppData\Local\Temp\is-Q0DDES8OOW.tmp\Slime Rancher 2_C2Tl-n7.tmp
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostObserved
108.156.248.214
Contact observed during runtime.
06Isolated runtime analysis - Contacted hostObserved
13.226.242.144
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 108.156.248.214
- 13.226.242.144
- 18.238.136.23
- 161.69.238.13
- 104.18.24.17
- 18.238.176.41
- 13.226.251.76
- 99.84.118.90
- 18.154.101.42
- 34.216.201.214
- http://crls.ssl.com/SSLcom-TLS-Root-2022-ECC.crl
- http://crls.ssl.com/SSL.com-TLS-T-ECC-R2.crl
- https://d2cxzkcwhivupa.cloudfront.net/o
- https://d2cxzkcwhivupa.cloudfront.net/zbd
- https://d2cxzkcwhivupa.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png
- https://d2cxzkcwhivupa.cloudfront.net/f/WebAdvisor/images/NEW/EN.png
- C:\Users\<USER>\AppData\Local\Temp\is-S0NSRTQ6HC.tmp\executable.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-Q0DDES8OOW.tmp\Slime Rancher 2_C2Tl-n7.tmp
- C:\Users\user\AppData\Local\Temp\is-ZIKV2JAH0Z.tmp
- C:\Users\user\AppData\Local\Temp\is-ZIKV2JAH0Z.tmp\Slime Rancher 2_C2Tl-n7.tmp
- C:\Users\user\AppData\Local\Temp\is-P5956S1PV4.tmp
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache.
- dc8c86bf2ce73f88cf48…ecf0f3Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 3rule hits recorded
- 21 / 75engines flagged
- 3sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
21 of 75 antivirus engines flagged the file, including AhnLab-V3 and ALYac.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The file has a valid code signature from Infivora.
ProvenanceObservedSourceCode-signing metadataObserved at - 04
Scanned file: Slaves of Nautica_K1y-cf2.exe — 9f88972dac4a2ac777f899a4ae70fc5ac246c142f50267187932d61b43bf2234
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\executable.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\is-S0NSRTQ6HC.tmp\executable.tmp" /SL5="$5002A,14880881,843264,C:\Users\<USER>\Desktop\executable.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: executable.tmp — C:\Users\<USER>\AppData\Local\Temp\is-S0NSRTQ6HC.tmp\executable.tmp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: Slime Rancher 2_C2Tl-n7.tmp — C:\Users\<USER>\AppData\Local\Temp\is-Q0DDES8OOW.tmp\Slime Rancher 2_C2Tl-n7.tmp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: 108.156.248.214 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 10
Contacted host: 13.226.242.144 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: pua
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
EvidenceC:\Windows\System32\svchost.exe -k NetworkService -pSandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
EvidenceC:\Windows\system32\lsass.exeThe sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence108.156.248.214 · 13.226.242.144 · 18.238.136.23
21 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 21 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Fingerprint and provenance
- File name
- Slaves of Nautica_K1y-cf2.exe
- Format
- Win32 EXE
- Code signing
- Signature valid: Infivora
- Size
- 15.4 MB
- Last analyzed
- Aug 23, 2026, 10:30 PM UTC
9f88972dac4a2ac777f899a4ae70fc5ac246c142f50267187932d61b43bf2234Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't run this file. Delete this file from the device, then empty the Recycle Bin or Trash.
- Recovery step 02
If you already ran it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Get a fresh copy from the developer's official site or an official app store.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is Slaves of Nautica_K1y-cf2.exe a virus?
What is Slaves of Nautica_K1y-cf2.exe?
How many antivirus engines detected Slaves of Nautica_K1y-cf2.exe?
What should I do if I already ran Slaves of Nautica_K1y-cf2.exe?
How do I remove Slaves of Nautica_K1y-cf2.exe?
What kind of malware is Slaves of Nautica_K1y-cf2.exe?
Is Slaves of Nautica_K1y-cf2.exe digitally signed?
What is the SHA-256 hash of Slaves of Nautica_K1y-cf2.exe?
How up to date is this analysis of Slaves of Nautica_K1y-cf2.exe?
Community
Member reviews and reports for this exact file hash.