SUSPICIOUS — 56574b830061167295ea9b4b075a3c4ac2b61a327eeb44d610e0d8f5c1fce1ed

SUSPICIOUS — 56574b830061167295ea9b4b075a3c4ac2b61a327eeb44d610e0d8f5c1fce1ed is a script sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (41/100). 2 of 50 detection engines flagged it.

Identification

• SHA-256: 56574b830061167295ea9b4b075a3c4ac2b61a327eeb44d610e0d8f5c1fce1ed
• SHA-1: f0823764e7a7cfc2b2ba2a9d9f04b5463b3453d3
• MD5: ff12f63d0c2ad290140d238c24be3f27
• ssdeep: 768:/jnLm2IU4cGN038Z7rgJYZTJaJmbbNAXwczPllK+dQoF3gu7JGZDCQfyBu:/Jc9sMPeXwYllK+dQoF3gu7gIQfyE
• TLSH: T11139966F3B35BDDF584745E8BA84603F344B25C2661040E9D788BF89AC93E944828D6F
• Submitted as: 56574b830061167295ea9b4b075a3c4ac2b61a327eeb44d610e0d8f5c1fce1ed
• File type: script · Size: 89348 bytes
• Verdict: suspicious (41/100)

Detections (2 of 50 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 41/100 is the fusion of 1 weighted signal:

• Obfuscated powershell script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• file.name

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report