MALICIOUS — 4fe7c698f2385d75fb4887cc78ad2da1d3237be18a2c67aae593046d60af3e69

MALICIOUS — 4fe7c698f2385d75fb4887cc78ad2da1d3237be18a2c67aae593046d60af3e69 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Reline family. 7 of 52 detection engines flagged it.

Identification

• SHA-256: 4fe7c698f2385d75fb4887cc78ad2da1d3237be18a2c67aae593046d60af3e69
• SHA-1: f0c66b8e4858d828dbaccf5310668536d903f331
• MD5: 2b4a67702949310582a7e84f6aa10214
• imphash: 4328f7206db519cd4e82283211d98e83
• ssdeep: 49152:EuSk13gvRUWXUnn0HIyb1PSVRkvRptLWBx/cY2vTHkJl6vdDMgqAnfEv3foi3D+:EZFVUnnmIz+ZvqdOYydfEv3p3D
• TLSH: T1935EE0588F1635FFC1D4A538501C7D8E390201D2915FCCA99783F13EAAE16E372A62B6
• Submitted as: 4fe7c698f2385d75fb4887cc78ad2da1d3237be18a2c67aae593046d60af3e69
• File type: pe · Size: 2880808 bytes
• Verdict: malicious (93/100) · Family: Reline

Detections (7 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
• ClamAV (daily): Win.Dropper.Reline-9906719-0
• Detect It Easy (packer/type): DIE:wxWidgets
• LIEF (executable format parser): lief:invalid-authenticode
• Microsoft Defender: Trojan:MSIL/Reline.BE!MTB
• Emsisoft (Emergency Kit): Trojan.Agent
• Kaspersky (KVRT): UDS:Trojan-Spy.Win32.Stealer.ahnz

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Reline-9906719-0 (rule Win.Dropper.Reline-9906719-0) - engine signal, weight 0.90, confidence 0.95
• Detect It Easy (packer/type) flagged DIE:wxWidgets (rule DIE:wxWidgets) - engine signal, weight 0.35, confidence 0.70
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,£€^â‚,.boot,£€^â‚,£€^â‚, wxWidgets - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• https://sectigo.com/CPS0D
• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
• https://www.digicert.com/CPS0
• http://www.digicert.com/ssl-cps-repository.htm0
• http://crl3.digicert.com/sha2-assured-ts.crl02
• http://crl4.digicert.com/sha2-assured-ts.crl0

Embedded domains

• c.xyz
• color.xyz
• adjacentcolor.xyz
• schemas.microsoft.com
• sectigo.com
• crl.sectigo.com
• crt.sectigo.com
• crl.usertrust.com
• crt.usertrust.com
• crl3.digicert.com
• crl4.digicert.com
• www.digicert.com
• cacerts.digicert.com

File paths

• R:\L\
• r:\:D

More Reline samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report