MALICIOUS — 5d035ab821ed72322fb6f195483adf069fcaa41a17c19bfdbcf577fc11071d5f

MALICIOUS — 5d035ab821ed72322fb6f195483adf069fcaa41a17c19bfdbcf577fc11071d5f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Rahiwi family. 5 of 25 detection engines flagged it.

Identification

SHA-256: 5d035ab821ed72322fb6f195483adf069fcaa41a17c19bfdbcf577fc11071d5f
SHA-1: 27434b3329392082354077c51530c24ba2a7e7ca
MD5: 66bfb8ed2340a395a050c59ad3027b7b
imphash: 1b675db9a912fecbf83526e2fd37cf23
ssdeep: 6144:2WC4YgB9Giy7WC4YgB9Giy8mWC4YgB9GiygWC4YgB9GiyMWC4YgB9Giy8mWC4Ygg:FtJ9GiXtJ9Gi7VtJ9GiatJ9GiKtJ9GiI
TLSH: T14B45E1C3653A3616DED7B4FA2084150F67A9C4801C7BECD44E6B81187B2872B68FD867
Submitted as: 5d035ab821ed72322fb6f195483adf069fcaa41a17c19bfdbcf577fc11071d5f
File type: pe · Size: 281421 bytes
Verdict: malicious (82/100) · Family: Rahiwi

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): Petite
Detect It Easy (packer/type): DIE:Petite 2.2
Microsoft Defender: Worm:Win32/Rahiwi!pz
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.75
Kaspersky (KVRT): Email-Worm.Win32.Brontok.am

Why this verdict

The malicious score of 82/100 is the fusion of 4 weighted signals:

Microsoft Defender flagged Worm:Win32/Rahiwi!pz (rule Worm:Win32/Rahiwi!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.VB.75 (rule Gen:Variant.Worm.VB.75) - engine signal, weight 0.55, confidence 0.85
Detect It Easy (packer/type) flagged DIE:Petite 2.2 (rule DIE:Petite 2.2) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Petite, high-entropy-sections:.petite, Petite 2.2 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Rahiwi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report