MALICIOUS — 885bf0d75869c084ca3e868fe42d7168c7cc9b32153b459b85a4da07a92be4c1
MALICIOUS — 885bf0d75869c084ca3e868fe42d7168c7cc9b32153b459b85a4da07a92be4c1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Avlj family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
885bf0d75869c084ca3e868fe42d7168c7cc9b32153b459b85a4da07a92be4c1 - SHA-1:
9b24119cb1953739842c76d6b70a9e189a56ead3 - MD5:
32b2075cad39e4ac1745ea517aab33c6 - imphash:
d41d8cd98f00b204e9800998ecf8427e - ssdeep:
1536:ACHFo6rdELT8hn2Ep7WzPdVj6Ju8B3AZ242UdIAkD4x3HT4hPVoYdVQtME9/sg1:ACHFo8dSE2EwR4uY41HyvYME9/sv - TLSH:
T12338BF65FD7F9E70E9BEEC6974D4D13D825270D1A9EE23081B4040212874E6738E629F - Submitted as: 885bf0d75869c084ca3e868fe42d7168c7cc9b32153b459b85a4da07a92be4c1
- File type: pe · Size: 80384 bytes
- Verdict: malicious (91/100) · Family: Avlj
Detections (6 of 52 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- ClamAV (daily): Win.Malware.Avlj-9877624-0
- Microsoft Defender: Trojan:MSIL/Heracles.AHR!MTB
- Emsisoft (Emergency Kit): Trojan.GenericKDZ.109203
- Kaspersky (KVRT): HEUR:Backdoor.MSIL.Agent.gen
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Win.Malware.Avlj-9877624-0 (rule
Win.Malware.Avlj-9877624-0) - engine signal, weight 0.90, confidence 0.95 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
More Avlj samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report