MALICIOUS — 96a44769733da70aaa63e62a88d3cf15c0da78ca1d2f3999ded847b6e6fada00.exe

MALICIOUS — 96a44769733da70aaa63e62a88d3cf15c0da78ca1d2f3999ded847b6e6fada00.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the execute family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 96a44769733da70aaa63e62a88d3cf15c0da78ca1d2f3999ded847b6e6fada00
SHA-1: 0c86e0e41a6c45ce7d25e52c4582d06ed2edf60f
MD5: 5199716fa194845ff7b91382f9686216
imphash: b1c022f21e313c400a3bd74350a836c9
ssdeep: 98304:B5K1hoM1VR+6w96rOIy/BDH5Bw9JW5/GNw7TCexxeW96oGhagcpjW7BDYuMHMOi:B5K1hj1m96Wr5+NOGh8pi7dYXLiDaWc
TLSH: T1BD61D07A022F3490E0FEA9E4BC4C6ECCC0E5B1699433AB558543DF0E5801957EEE646E
Submitted as: 96a44769733da70aaa63e62a88d3cf15c0da78ca1d2f3999ded847b6e6fada00.exe
File type: pe · Size: 4045824 bytes
Verdict: malicious (92/100) · Family: execute

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

capa (capabilities): execute via PowerShell
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Malgent
Emsisoft (Emergency Kit): Trojan.GenericKD.80945939
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 92/100 is the fusion of 9 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in rundll32.exe (pid 5784) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80945939 (rule Trojan.GenericKD.80945939) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 4.2.1.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

54 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

39fe5aafc2465dda95d2356ee6be3ddeb31f8c3a4c386b4f23b73ec3af884b45 - 39fe5aafc2465dda95d2356ee6be3ddeb31f8c3a4c386b4f23b73ec3af884b45

Embedded URLs

https://aka.ms/nativeaot-compatibilit

Embedded domains

aka.ms
staging.to-do.officeppe.com
teams.cloud.microsoft
outlook.cloud.microsoft
searchapp.bundleassets.example
www.msftconnecttest.com
outlook.office.com
outlook.office365.com
www.bing.com
config.edge.skype.com
tas02.sls.update.microsoft.com
dns.msftncsi.com
to-do.microsoft.com
settings-win.data.microsoft.com
ctldl.windowsupdate.com
staging.to-do.microsoft.com
edge.microsoft.com
teams.microsoft.com
aps.prod.windows.com
g.live.com
ecs.office.com
fs.microsoft.com
www.msftncsi.com
self.events.data.microsoft.com
watson.events.data.microsoft.com

Embedded IP addresses

4.2.1.0

More execute samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report