MALICIOUS — 4e9e7c5b12649be29a147677161d6bee2826074e05c9f103a39da869dba6c580

MALICIOUS — 4e9e7c5b12649be29a147677161d6bee2826074e05c9f103a39da869dba6c580 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the ASPack family. 7 of 51 detection engines flagged it.

Identification

SHA-256: 4e9e7c5b12649be29a147677161d6bee2826074e05c9f103a39da869dba6c580
SHA-1: 1f4ef80d08ec725b9f378ca7337d96e782fc0de6
MD5: 96e84171a72efc64f3fe142d65983dc4
imphash: ac99a5a6590e07f40380584be971cd01
ssdeep: 12288:RIbnq5ORFftIiB6gBFvST9kFO14SFoktWEY+ucXz+J6nJELcUmQ+7O:RIbq0ft8gLvoko1hmkQ5cXzyvL/L
TLSH: T1A14B239A153A015BD145B09C36029B3FC3A873A593FD9BCC3A632D832253963C97E563
Submitted as: 4e9e7c5b12649be29a147677161d6bee2826074e05c9f103a39da869dba6c580
File type: pe · Size: 480307 bytes
Verdict: malicious (91/100) · Family: ASPack

Detections (7 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Trojan.Agent-1132946
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Kaspersky (KVRT): HEUR:Trojan.Win32.Urelas.a
Microsoft Defender: Trojan:Win32/Urelas.HNS!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Heur.Dmrar9EqNypGy
Trellix Stinger (McAfee): Obfuscated-FQZ!hb

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1132946 (rule Win.Trojan.Agent-1132946) - engine signal, weight 0.90, confidence 0.95
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

s.ai

More ASPack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report