MALICIOUS — 71f17c5e06548f128eb4f0cfafd247cc79894331f996c383fa5c2bcddfe9c5b8.exe

MALICIOUS — 71f17c5e06548f128eb4f0cfafd247cc79894331f996c383fa5c2bcddfe9c5b8.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 5 of 55 detection engines flagged it.

Identification

• SHA-256: 71f17c5e06548f128eb4f0cfafd247cc79894331f996c383fa5c2bcddfe9c5b8
• SHA-1: 9d8da374ef6eb7d66464420db904f6b66f1dbc83
• MD5: f3ca8dae4ea1332aff145624a1a1b452
• imphash: 4c458afe79fc44477eb7dbbae93b93c4
• ssdeep: 49152:syuV1hXhq3eb2JEaXfrvndGJJUJIVajUndqvm3DV1CrNhdEEfWpVmnwXYc:SVBq3A2CaPZGJJjaonZTV8phdmInS
• TLSH: T1185E224AF1253E1ECE62BD247D27677D1927B507A29029CCA1807887649CDAF93F00F6
• Submitted as: 71f17c5e06548f128eb4f0cfafd247cc79894331f996c383fa5c2bcddfe9c5b8.exe
• File type: pe · Size: 2941680 bytes
• Verdict: malicious (87/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.#deC
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Microsoft Defender: Trojan:Win64/RemusStealer.SQE!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40361557
• Kaspersky (KVRT): VHO:Backdoor.Win64.Convagent.gen

Why this verdict

The malicious score of 87/100 is the fusion of 2 weighted signals:

• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Packing/obfuscation: high-entropy-sections:.#deC - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl05
• http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
• http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
• https://sectigo.com/CPS0J

Embedded domains

• yj2.us
• crl.usertrust.com
• crl.sectigo.com
• crt.sectigo.com
• sectigo.com

File paths

• I:\pz/

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report