MALICIOUS — 8ddd700c118dec6bedb39ec95094630cd76c4cad94a8da68f3363c758d6cac81
MALICIOUS — 8ddd700c118dec6bedb39ec95094630cd76c4cad94a8da68f3363c758d6cac81 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 4 of 52 detection engines flagged it.
Identification
- SHA-256:
8ddd700c118dec6bedb39ec95094630cd76c4cad94a8da68f3363c758d6cac81 - SHA-1:
21c61f7f732e52e8cbe92ebedc2103219f130e78 - MD5:
04a4441b20633b6e35110a9707c3aa98 - imphash:
38aa7c2ff6ef0e48a9520d6702d08df4 - ssdeep:
3072:3nEOvigO5+TyixiUEFMFnTiSvAZToEE6ooqiq8EpKP1dwLFurHNe:5vib+TyixiUEFMFnTiSod1E6dqi4py5e - TLSH:
T101405BA71160657FD3F1484F102CBE7E80C6A8F66A740789A2C8E6D04174477B2B7B6B - Submitted as: 8ddd700c118dec6bedb39ec95094630cd76c4cad94a8da68f3363c758d6cac81
- File type: pe · Size: 177250 bytes
- Verdict: malicious (89/100)
Detections (4 of 52 engines)
- ClamAV (daily): Win.Trojan.Agent-6943819-1
- Microsoft Defender: Virus:Win32/Sivis.A
- Emsisoft (Emergency Kit): Win32.Sivis.A
- Kaspersky (KVRT): Virus.Win32.Agent.es
Why this verdict
The malicious score of 89/100 is the fusion of 2 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule
Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://creativecommons.org/publicdomain/zero/1.0/
- http://www.gnu.org/software/coreutils/
- http://translationproject.org/team/
- http://gnu.org/licenses/gpl.html
- http://www.gnu.org/gethelp/
- http://www.gnu.org/licenses/
Embedded domains
- creativecommons.org
- www.gnu.org
- translationproject.org
- gnu.org
- cygwin.com
- geocities.com
- cwru.edu
File paths
- X:\windows\system32\sysreset.exe
- X:\windows\system32\Dism\SiloedPackageProvider.dll.
- X:\windows\system32\Dism\MetaDeployProvider.dll.
- C:\Windows
- C:\$WINDOWS.~BT\NewOS\Windows
- C:\,
- C:\inetpub
- C:\Windows.old\inetpub,
- C:\SkyDriveTemp
- C:\Windows.old\SkyDriveTemp,
- C:\Recovery
- C:\Windows.old\Recovery,
- C:\Windows.old\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows\containers\serviced\WindowsDefenderApplicationGuard.wim]
- C:\Windows.old\Recovery]
- C:\Recovery\ReAgentOld.xml)
- C:\Windows.old]
- C:\Reset_SafeToDelete_OverwriteSpaceFile_0.tmp]
- C:\Windows\System32\ResetEngine.exe
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report