SUSPICIOUS — SMALL FONT.rar

SUSPICIOUS — SMALL FONT.rar is a archive sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 54 detection engines flagged it.

Identification

• SHA-256: 41b3813c6446f9d0a1e0684c7680bb1c9673440d368ce8b4d487a9917145990a
• SHA-1: 7a0e43aa5b1962467e1316ca0a4666a22fbb177b
• MD5: be9ae3fe541b8f075b6e0370d3d85ff0
• ssdeep: 98304:1X/e4/20Mgu2p6l+wI/iJi8v1wpBf/t8YqfEP2gtCW0lAAhKil8XgnlVR3a7FwNU:Jt2cwl+Hkv1wf/mYqfExtWK6RnlXa7ph
• TLSH: T1306533A1E672543CA1A2F3FBE2C1D4BB3E85467511A3DF9903C9BD8035A261B5912CF0
• Submitted as: SMALL FONT.rar
• File type: archive · Size: 5719909 bytes
• Verdict: suspicious (35/100)

Detections (1 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 35/100 is the fusion of 2 weighted signals:

• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Embedded domains

• 9.ly
• e.ly

File paths

• F:\X2
• n:\^:
• x:\Q@Z

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report