SUSPICIOUS — xnafx40_redist.msi

SUSPICIOUS — xnafx40_redist.msi is a msi sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 47260420773a20443fb1e38a89b7f39c5237a80a842de598e6c8f7f90a3bbd6d
• SHA-1: 5fc95a9ad87a38e71a953af116fd1f1cbe46a3e7
• MD5: ff1c0202ab7147c9dfd34b582f1da13f
• ssdeep: 98304:synfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:sYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
• TLSH: T1186722B58E6A3DD7F2660BE59F21DB1C143341A75264802B4B40E0BEDA5F71BB83B424
• Submitted as: xnafx40_redist.msi
• File type: msi · Size: 7054848 bytes
• Verdict: suspicious (35/100)

Detections (1 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob

Why this verdict

The suspicious score of 35/100 is the fusion of 2 weighted signals:

• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule high-entropy-blob) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://devblogs.microsoft.com/directx/
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/xna0

Embedded domains

• bi.uk
• lk.jp
• vc.ly
• column.name
• dialog.name
• www.microsoft.com
• crl.microsoft.com
• devblogs.microsoft.com

File paths

• F:\!^]
• L:\/

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report