MALICIOUS — 34ef24a700926ba1de3366a617dae590fa087fb7a37942bb8ffe51fbe468872c.exe
MALICIOUS — 34ef24a700926ba1de3366a617dae590fa087fb7a37942bb8ffe51fbe468872c.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (72/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
34ef24a700926ba1de3366a617dae590fa087fb7a37942bb8ffe51fbe468872c - SHA-1:
bf9ed1540471faf4bea966462ef08a5c1cc50e8b - MD5:
ffcca2a80c1ccc7207d3a8e0fc48104e - imphash:
59ca5585bd630976be7da0ca80d5ec01 - ssdeep:
49152:1loM/tz370yjHEhFbPQ6J4frz4Cg6YLXXrvXrSHfj1Bkgxa9BEkCovzWfDq8mbd:TCy6PCPxHO+xzrtNVxMy - TLSH:
T17462AF5152076033F0B2A9C8DC8048ECB192FDADA43C519AA687DE1C52DDE37FDE12A5 - Submitted as: 34ef24a700926ba1de3366a617dae590fa087fb7a37942bb8ffe51fbe468872c.exe
- File type: pe · Size: 4231600 bytes
- Verdict: malicious (72/100) · Family: HUILoader
Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified
Detections (6 of 55 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- LIEF (executable format parser): lief:invalid-authenticode
- Microsoft Defender: Trojan:Win32/Sabsik.EN.A!ml
- Emsisoft (Emergency Kit): Trojan.Generic.40367869
- Kaspersky (KVRT): UDS:Trojan.Win64.Patched
MITRE ATT&CK
Why this verdict
The malicious score of 72/100 is the fusion of 5 weighted signals:
- capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - LIEF (executable format parser) flagged lief:invalid-authenticode (rule
lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.winimage.com/zLibDll, http://terrainformatica.com/forums/topic.php?id=1772, http://pki.eset.com/crt/csca2020.crt05 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.winimage.com/zLibDll
- http://terrainformatica.com/forums/topic.php?id=1772
- http://www.digicert.com/CPS0
- http://pki.eset.com/crt/csca2020.crt05
- http://pki.eset.com/crl/csca2020.crl0I
- http://pki.eset.com/csp0
- http://pki.eset.com/crt/rootca2020.crt07
- http://pki.eset.com/crl/rootca2020.crl0
- http://pki.eset.com/crt/tsca2020.crt05
- http://pki.eset.com/crl/tsca2020.crl0
- http://terrainformatica.com
Embedded domains
- www.winimage.com
- www.terrainformatica.com
- terrainformatica.com
- td.today
- span.today
- cacerts.digicert.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
- crl.microsoft.com
- pki.eset.com
- www.libpng.org
- www.zlib.org
- www.ijg.org
- www.antigrain.com
- www.garret.ru
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report