MALICIOUS — 4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617.exe

MALICIOUS — 4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 5 of 55 detection engines flagged it.

Identification

• SHA-256: 4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617
• SHA-1: aa4071641df7b352326f837d785a4d73926ccd7d
• MD5: 1e3980e87f5c0baa0514e6e6338cbc15
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 24576:5eA9skmmJSmUapFMWl5VEtDj0BFI7StMlyE5widI2BehFRPjG7CZx0Q05:gUskRD8Wit8B5jEzGVTRPy7CZxr
• TLSH: T14157235F628C4901D5E2807A698151EEF8EC26571CA8A28DC7433C5B16DBCB36C398E6
• Submitted as: 4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617.exe
• File type: pe · Size: 1594368 bytes
• Verdict: malicious (87/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:MSIL/Noon.ABFG!MTB
• Emsisoft (Emergency Kit): Generic.Dacic.20388.2AE91315
• Kaspersky (KVRT): HEUR:Trojan-Spy.MSIL.Noon.gen

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• 4i.me

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report