SUSPICIOUS — 2d2919e6ef0309f0f3cb46ca4780426d82b86626f294d130fba900aa2874b0b0.bin

SUSPICIOUS — 2d2919e6ef0309f0f3cb46ca4780426d82b86626f294d130fba900aa2874b0b0.bin is a archive sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: 2d2919e6ef0309f0f3cb46ca4780426d82b86626f294d130fba900aa2874b0b0
• SHA-1: a29530fa95341233c0a9db60dcdee1db86b8b478
• MD5: a35db0a74f2fc551476117a080c3e914
• ssdeep: 393216:/3VPcolQqGoVFRJUkLJuuROJhSlczTHQ:fDJGovRJzukQTHQ
• TLSH: T1D96E33112E4BF7546B82EDDC190EA5BC513FE426164F1F6C02B106C9CBF9CB927486A8
• Submitted as: 2d2919e6ef0309f0f3cb46ca4780426d82b86626f294d130fba900aa2874b0b0.bin
• File type: archive · Size: 13746585 bytes
• Verdict: suspicious (35/100)

Source: MalShare · first seen 2026-09-16T13:17:35.245Z · SHA-256 verified

Detections (1 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 35/100 is the fusion of 3 weighted signals:

• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• archive:unopenable — contents were NOT scanned: listing failed: Command failed: 7zz l -slt -pzippw -- /tmp/tl-collect-mIPO8O/sample.archive ERROR: /tmp/tl-collect-mIPO8O/sample.archive : Cannot open encrypted archive. Wrong password? - static signal, weight 0.00, confidence 0.00

Dynamic analysis

This archive is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• 3.ly
• e.sg

File paths

• C:\Yi
• m:\&Nm;
• h:\2m
• L:\sR
• i:\5
• G:\\y
• e:\:
• E:\`CV

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report