CLEAN — libijkffmpeg.so

CLEAN — libijkffmpeg.so is a elf sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (31/100). 1 of 55 detection engines flagged it.

Identification

• SHA-256: 6bf0e01ac70c134d0bc8c80767a2f0137e8d32657dd4651d68d74d05167b4678
• SHA-1: 3606b7d648456836fbe25dd4f8ce5d7d9eb44b28
• MD5: c89a0c38d73412da9fc98936e226cd96
• ssdeep: 49152:4F/hInx2xfDRzEJBugsjlZd6n7ROBxJSMfGFVSCj6g+853zDZcF79ksU+3WR4k0:85IMxRnJGSc6/8pnZyL3HkEzUS/m
• TLSH: T1E165CF8A54846D0AE9ED4C5CFAE29A2C828754AD627A1BCE61D70F13E0C37774E74C13
• Submitted as: libijkffmpeg.so
• File type: elf · Size: 5775088 bytes
• Verdict: clean (31/100)

Detections (1 of 55 engines)

• YARA: Stratosphere IPS: STRATO_Malicious_UserAgent

Why this verdict

The clean score of 31/100 is the fusion of 1 weighted signal:

• YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70

Dynamic analysis

This sample is built for AArch64, which no sandbox guest in our fleet executes, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

Embedded URLs

• http://www.w3.org/2001/SMIL20/Language

Embedded domains

• openssl.org
• www.w3.org
• upload.ffmpeg.org
• ffmpeg.org
• handshake.cc

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report