SUSPICIOUS — 5f1b13bf8d2dac5bfdb44be04df7796dcfd5149e838d22ba4694c059c31dabbd

SUSPICIOUS — 5f1b13bf8d2dac5bfdb44be04df7796dcfd5149e838d22ba4694c059c31dabbd is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (53/100), attributed to the Vindor family. 2 of 25 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 5f1b13bf8d2dac5bfdb44be04df7796dcfd5149e838d22ba4694c059c31dabbd
• SHA-1: 0e5a4b73d1a627e71c1a473754b7d3037027640a
• MD5: 1ba1abdb899a32f5aca11ecbf9fa6661
• imphash: fb3d0a9cf63dfa8698555596b6c0c5e8
• ssdeep: 384:jYxWwue/4youZfWkXiWgEiSZexdiHsd2E0S8NrjpWKV:jYx+6dWailEl0iMk6ErkA
• TLSH: T1B435C7EE0F32DE80C9B1CE83F4C91A1D2053396037A9514DA756959BA7F38A7683C42D
• Submitted as: 5f1b13bf8d2dac5bfdb44be04df7796dcfd5149e838d22ba4694c059c31dabbd
• File type: pe · Size: 59872 bytes
• Verdict: suspicious (53/100) · Family: Vindor

Detections (2 of 25 engines)

• Microsoft Defender: Trojan:Win32/Vindor!pz
• Kaspersky (KVRT): UDS:Trojan-Dropper.Win32.VB.gen

MITRE ATT&CK

• T1057

Why this verdict

The suspicious score of 53/100 is the fusion of 2 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report