MALICIOUS — 3bc2cb381934db49f3c396a46f35d2a404a65f4ffd7fc145df28276ec7303fca.bin
MALICIOUS — 3bc2cb381934db49f3c396a46f35d2a404a65f4ffd7fc145df28276ec7303fca.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the MSILZilla family. 1 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
3bc2cb381934db49f3c396a46f35d2a404a65f4ffd7fc145df28276ec7303fca - SHA-1:
f91a8b1496b4ff7581af64e1a8c4de4804d567ca - MD5:
1b8fdad65f4d30411e7b4a33793ff535 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
384:oGnpRmo9h00KlteCIdI4lrHFoCwzINwAhqaHO7d+Go4drNjOAdkCMua2ubOLXE:rpRlL86snkuAhLO5ZrNjOMMuhuj - TLSH:
T1002FD6CF55885A01E8F4EA825D70D87C193134DBD3F5368AAF439E29C6B842F6839163 - Submitted as: 3bc2cb381934db49f3c396a46f35d2a404a65f4ffd7fc145df28276ec7303fca.bin
- File type: pe · Size: 33792 bytes
- Verdict: malicious (91/100) · Family: MSILZilla
Source: MalShare · first seen 2026-08-01T21:51:52.765Z · SHA-256 verified
Detections (1 of 52 engines)
- Emsisoft (Emergency Kit): IL:Trojan.MSILZilla.257866
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 6 weighted signals:
- Emsisoft (Emergency Kit) flagged IL:Trojan.MSILZilla.257866 (rule
IL:Trojan.MSILZilla.257866) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 28 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
10631 behavior events · 2 ATT&CK techniques · 11 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- www.bing.com
- assets.msn.com
- licensing.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- slscr.update.microsoft.com
- v10.events.data.microsoft.com
- watson.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
Dropped files
- 40f60f608aaff756eaa9174065d055fae2e94b41584ef4d8720763d0c1ca7bc7 -
40f60f608aaff756eaa9174065d055fae2e94b41584ef4d8720763d0c1ca7bc7 - 2b88fa2fda268b17ef06ef3a8708f8ae838de0d13a6095c894248fedc97c9ada -
2b88fa2fda268b17ef06ef3a8708f8ae838de0d13a6095c894248fedc97c9ada - a65dfe0bcdd7898e35db3a8d30a8267e358b25f1a99a7f87359256f605051394 -
a65dfe0bcdd7898e35db3a8d30a8267e358b25f1a99a7f87359256f605051394 - 6747d2e3287a4033fe149c85b3d72606dcc60accf26fc4a7e01e5cf8aeb50c71 -
6747d2e3287a4033fe149c85b3d72606dcc60accf26fc4a7e01e5cf8aeb50c71 - bb305c1b598883120ca132ae8e3f142532eaf5953aaa4481187e78d5b7f991f2 -
bb305c1b598883120ca132ae8e3f142532eaf5953aaa4481187e78d5b7f991f2 - f478488b8fb5b99b1eaa0d557efcda16c67dd68a51d36e9ce6ecef5440ba1b11 -
f478488b8fb5b99b1eaa0d557efcda16c67dd68a51d36e9ce6ecef5440ba1b11 - e848496aeef2f1815c1b090125ef758ed5984c366346a898ac6dac95015cff8f -
e848496aeef2f1815c1b090125ef758ed5984c366346a898ac6dac95015cff8f - 1112f80a8bb2e5a713b720e5cf3bfd80145a338ee89ce272c5d112dc3a3dcfe6 -
1112f80a8bb2e5a713b720e5cf3bfd80145a338ee89ce272c5d112dc3a3dcfe6 - 374bf699296bd70b46ef2442172007519cd88b368e135fdf1c388f932b329037 -
374bf699296bd70b46ef2442172007519cd88b368e135fdf1c388f932b329037 - ecc43de325759f4fdc22dbf25e89512b8f46453475cb9c6d5e26990368339b8c -
ecc43de325759f4fdc22dbf25e89512b8f46453475cb9c6d5e26990368339b8c - e766239f1ca510bd86c5a2f522befb9427a46a3015a30a385eb8a482f0a79f78 -
e766239f1ca510bd86c5a2f522befb9427a46a3015a30a385eb8a482f0a79f78
Embedded URLs
- http://schemas.microsoft.com/winfx/2006/xaml
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786226073&P2=404&P3=2&P4=i%2fn4Dcxby1Mzq5i2tV7kHWIG7uVOKVCtW2766Lot1CCnzdK1D2NoaQKtVuoU4VeFpiVmfY3fHPyr7rexI349xw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786226101&P2=404&P3=2&P4=NkZ8PDj8kTy0jyUEsEzfl7kiO8%2bY0l%2f%2f4DxlgwHC2B%2boERXoi5VpeETghwHVruwkb7CKlrdMyJG4uKV2zDm8ZA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- schemas.microsoft.com
Embedded IP addresses
- 20.42.65.94
- 52.123.252.216
- 4.230.171.124
- 20.247.184.142
- 135.233.95.135
- 74.179.77.204
- 40.84.97.4
- 52.168.117.171
- 172.178.240.162
- 172.178.240.163
- 20.165.94.46
- 203.26.79.13
- 172.215.188.225
- 52.148.114.188
- 72.145.35.102
- 52.110.12.22
- 52.110.12.45
File paths
- C:\Users\ali99\source\repos\WpfLoader\WpfLoader\obj\Debug\WpfLoader.pdb
More MSILZilla samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report