SUSPICIOUS — 5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6.exe
SUSPICIOUS — 5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (61/100), attributed to the HUILoader family. 4 of 52 detection engines flagged it.
Identification
- SHA-256:
5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6 - SHA-1:
dc223e5e27e3bcc1cc636aa2b9567540868cc6ef - MD5:
658cb87887c1aa843e39aea3aab26073 - imphash:
88016fcdef7f227c62171d0afad9aae4 - ssdeep:
393216:YJSSRC8g954fV7n/YQ/toBGBUokPNXVu/QhDbzFbSx3TKBHfGM2a8Z:USSRtgHQFOBGBUxPDMQ5FbSCfGPdZ - TLSH:
T1A271238F735F661BC769D7201060B97F48F3EC4717BB8AC806A58A1EDEF4823156190A - Submitted as: 5f76fc369f3f759a64fe0770294a303c918c1dca5af021ba9ea0bbc7ab2559f6.exe
- File type: pe · Size: 17833552 bytes
- Verdict: suspicious (61/100) · Family: HUILoader
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (4 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): Turbo Linker
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Detect It Easy (packer/type): DIE:Turbo Linker
- Emsisoft (Emergency Kit): QD:Trojan.GenericKDQ.3BBBF0C4AF
Why this verdict
The suspicious score of 61/100 is the fusion of 4 weighted signals:
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, 7.0.0.3 - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: Turbo Linker - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
Embedded domains
- schemas.microsoft.com
- t.co
- q.cn
- 0.sh
- on.nl
- nz.gq
- bwq.uk
- u.ws
- ir.pl
- 8.sg
- jrsoftware.org
Embedded IP addresses
- 7.0.0.3
File paths
- T:\:d:l:p:t:x:
- X:\:`:d:h:l:
- X:\:`:d:h:l:p:t:x:
- X:\:j:
- M:\:d:t:
- E:\:j:}:
- X:\:`:d:h:l:p:t:
- T:\:d:l:t:
- C:\2
- l:\;
- R:\[ns(
- v:\_@
- C:\Coding\Is\issrc-build\Components\ChaCha20.pas
- x:\dirname
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report