MALICIOUS — 2d2875bb6b2b12b32bf723e716bdfe58186ad8e36b83aada53e333bb3c0e462d

MALICIOUS — 2d2875bb6b2b12b32bf723e716bdfe58186ad8e36b83aada53e333bb3c0e462d is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 2d2875bb6b2b12b32bf723e716bdfe58186ad8e36b83aada53e333bb3c0e462d
• SHA-1: b59110b2c5c809f1781dd1669371546d67b9c5fc
• MD5: db86e39b3efff1b708c0f76176c5fa7c
• ssdeep: 6144:rJ+SzI2XiBOq3T+4xKIN4UK01sUzRxa3wrjnLR52PS3iEvBpPMMD/7ijkBj:rJdIJ7KPq1NzRcgr/R5IS3iEvP
• TLSH: T1315768CBFA662C44A8D1A444DE5602EC001A5339E430DBF6DDC2C2895F6AE9DD2EDD1C
• Submitted as: 2d2875bb6b2b12b32bf723e716bdfe58186ad8e36b83aada53e333bb3c0e462d
• File type: macho · Size: 1507272 bytes
• Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

• ClamAV (daily): Osx.Adware.Adload-9890129-1
• Microsoft Defender: Adware:MacOS/Adload.D!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
• Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report