CLEAN — 08cd59e0c249b3ec24d9a3561dc2b163f844b400fad88081b3761d7318ceac55

CLEAN — 08cd59e0c249b3ec24d9a3561dc2b163f844b400fad88081b3761d7318ceac55 is a pe sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (32/100). 2 of 55 detection engines flagged it.

Identification

• SHA-256: 08cd59e0c249b3ec24d9a3561dc2b163f844b400fad88081b3761d7318ceac55
• SHA-1: 2332d1490de473eee5f527cff9cb939f2a9b6471
• MD5: 8a4ef67cd393a43094e0e92ca2d3916c
• imphash: 4ed22e17375f6d21f7c9d33fe8d359fa
• ssdeep: 196608:hvDXLkpU4WB3Ir0ioJGFM3ny+JoOWmKpg9:Ffkw20ioJGa3/Ums4
• TLSH: T1DF6633B911A09268F3EADF50C2707D1DA5652CEC4BA9FDC4DA93C41B8ED106B70D2836
• Submitted as: 08cd59e0c249b3ec24d9a3561dc2b163f844b400fad88081b3761d7318ceac55
• File type: pe · Size: 6626059 bytes
• Verdict: clean (32/100)

Detections (2 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Microsoft Defender: flagged

Why this verdict

The clean score of 32/100 is the fusion of 2 weighted signals:

• Embedded network infrastructure: http://sfxmaker.powerarchiver.com/, http://sfxmaker.powerarchiver.com, http://www.info-zip.org/pub/infozip/ - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://sfxmaker.powerarchiver.com/
• http://sfxmaker.powerarchiver.com
• http://www.info-zip.org/pub/infozip/
• http://www.powerarchiver.com
• http://sm.davidcornish.com

Embedded domains

• sfxmaker.powerarchiver.com
• www.info-zip.org
• www.powerarchiver.com
• 4.pw
• q.tw
• sm.davidcornish.com

Registry keys

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir

File paths

• z:\Pj
• u:\UG`
• O:\{`
• X:\s4
• w:\2
• s:\$

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report