MALICIOUS — 039d04a6a60a4d25a1dbefab544d7fa5a69796f976c9c3c6b81c35ec7bcb7fab

MALICIOUS — 039d04a6a60a4d25a1dbefab544d7fa5a69796f976c9c3c6b81c35ec7bcb7fab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Zeus family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: 039d04a6a60a4d25a1dbefab544d7fa5a69796f976c9c3c6b81c35ec7bcb7fab
• SHA-1: f1c7e14bb2f279de8ed9b116e926b3cf477c9f31
• MD5: d69ca0d4a6fb96fea9e5252611ce5bb2
• imphash: 6cffc97c1f028ec26c2f8abbe8680ceb
• ssdeep: 6144:XU0I6GrhUfbRDYVLHvxSG3y4GVij7s4nYiayol:ksyUjZwbRT7s
• TLSH: T16B43F183E53AA681FB96FB92FC121D8ED256402565F483C46AC8CDEF41D069FA53C01E
• Submitted as: 039d04a6a60a4d25a1dbefab544d7fa5a69796f976c9c3c6b81c35ec7bcb7fab
• File type: pe · Size: 220432 bytes
• Verdict: malicious (93/100) · Family: Zeus

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
• ClamAV (daily): Win.Dropper.Zeus-10018465-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Emsisoft (Emergency Kit): Gen:Variant.Ransom.Cerber.757
• Kaspersky (KVRT): UDS:Trojan.Win32.GenericML.xnet

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Zeus-10018465-0 (rule Win.Dropper.Zeus-10018465-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• H:\poeqwoqwpeqwo

More Zeus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report