MALICIOUS — 1db5eaa840becb044df10bda51bc167a407c9caca38e7c525a94686c03e755d0

MALICIOUS — 1db5eaa840becb044df10bda51bc167a407c9caca38e7c525a94686c03e755d0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the FuBu family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: 1db5eaa840becb044df10bda51bc167a407c9caca38e7c525a94686c03e755d0
• SHA-1: c77e63b639d8756ed1d437bf6d98f3bdfe0c011d
• MD5: 4c0d27964a8a9ed9d9f70acb5cd2d507
• imphash: 77f13bc24efea5a05601b43cf44d1f1a
• ssdeep: 3072:NR2FoCZAt2SbrIQqboqId5mtT4XOyVop6PsoB7LTKTeAk3PFU0tv/LD:NS6rIQqbamR4XOyV5R7LZPS0tnn
• TLSH: T14243AE9A122752A1E1B7CCA09C408DDC8033F4BE21B6654D9643DC6EB5F6933D9F218D
• Submitted as: 1db5eaa840becb044df10bda51bc167a407c9caca38e7c525a94686c03e755d0
• File type: pe · Size: 221081 bytes
• Verdict: malicious (89/100) · Family: FuBu

Detections (5 of 52 engines)

• ClamAV (daily): Win.Trojan.FuBu-1
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: flagged
• Emsisoft (Emergency Kit): Win32.HLLP.Shodi.A
• Kaspersky (KVRT): Virus.Win32.HLLP.Shodi.a

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Trojan.FuBu-1 (rule Win.Trojan.FuBu-1) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0

Embedded domains

• www.microsoft.com
• crl.microsoft.com

More FuBu samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report