MALICIOUS — 3119681008ce8b500271c811df23413aee3d06b74a449266e0a7d72169290ef2

MALICIOUS — 3119681008ce8b500271c811df23413aee3d06b74a449266e0a7d72169290ef2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Bingoml family. 4 of 52 detection engines flagged it.

Identification

• SHA-256: 3119681008ce8b500271c811df23413aee3d06b74a449266e0a7d72169290ef2
• SHA-1: b58a35dccade47e38d202e3aa726faee9cc7bf90
• MD5: 0ec21c5c40dd6cfebb53f06d36bb1462
• imphash: 95122753ea27818b35f9b51859e4c692
• ssdeep: 49152:Qoa1taC070dQ9UNRmGFJOa9sBvEj7aam:Qoa1taC07GLFJODBvf
• TLSH: T1E55A234A56597B4DE3F2C1803D19226EC481A4E7A37C258B828FF08EB3D7967742119B
• Submitted as: 3119681008ce8b500271c811df23413aee3d06b74a449266e0a7d72169290ef2
• File type: pe · Size: 1958400 bytes
• Verdict: malicious (92/100) · Family: Bingoml

Detections (4 of 52 engines)

• ClamAV (daily): Win.Malware.Zusy-9764479-0
• Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs
• Microsoft Defender: Trojan:Win32/Salgorea!pz
• Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E

Why this verdict

The malicious score of 92/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
• Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

• schemas.microsoft.com

File paths

• O:\41
• O:\f

More Bingoml samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report