CLEAN — 38cc4fb7c882290f0444c2e92f236ddbc7f4be099d3c44c8bf5b9ca949e775dd

CLEAN — 38cc4fb7c882290f0444c2e92f236ddbc7f4be099d3c44c8bf5b9ca949e775dd is a pe sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (25/100). 2 of 52 detection engines flagged it.

Identification

• SHA-256: 38cc4fb7c882290f0444c2e92f236ddbc7f4be099d3c44c8bf5b9ca949e775dd
• SHA-1: 157253b2ae79d2d2ad4783238ddb5e4621b96b3d
• MD5: 397b0bd8c0a5e050dc28ba67e35b6096
• imphash: d289668dfc2163a8d7ebe8a066b87241
• ssdeep: 49152:BFnYwtNFvswqrwoyt6+e8H2id/AfEvvGSbCokK:BFnFtN9OcLB2id/PvGSbLp
• TLSH: T1655923D5C14EE383DAA7EA20E9A04C4EA0A2B8D574FC349A97C3C05E2BD184FF515527
• Submitted as: 38cc4fb7c882290f0444c2e92f236ddbc7f4be099d3c44c8bf5b9ca949e775dd
• File type: pe · Size: 1830682 bytes
• Verdict: clean (25/100)

Detections (2 of 52 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Kaspersky (KVRT): Trojan.Win32.Cryprar.oh

Why this verdict

The clean score of 25/100 is the fusion of 1 weighted signal:

• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings

Embedded domains

• schemas.microsoft.com

File paths

• d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
• t:\]5

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report