MALICIOUS — 9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47.dll

MALICIOUS — 9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47
• SHA-1: 17110e2d546a2a610c0c052e3378ce6a23fc4c3e
• MD5: 958c2f22ec77871924613689f9fcc305
• imphash: 1f365d4e2c37b47fb208b089b5f61d49
• ssdeep: 24576:lbDyoBz/qLX2QfaWmapyBWZzgGKLWdAVQF1dAcFQU2:V/tC+cvcWZDAcaP
• TLSH: T1B9593BDFAB1B3202C66A97144171EABE04F7FC8B51B71C9D11EA891EF2F58133990912
• Submitted as: 9ac536e4a7d70a59672c164569a89c36776f08c5bcabec27eff2c4f0aa1b9d47.dll
• File type: pe · Size: 1809920 bytes
• Verdict: malicious (79/100) · Family: HUILoader

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Qwexlafiba!rfn
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.3902
• Kaspersky (KVRT): HEUR:Trojan.Win32.Inject.gen

MITRE ATT&CK

• T1547.001
• T1071.001
• T1497
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 79/100 is the fusion of 5 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://api.cloudflare.com/client/v4/zones?per_page=1000
• https://api.cloudflare.com/client/v4/

Embedded domains

• vnd.ahead.space
• vnd.digital
• vnd.net
• vnd.sun.j2me.app
• api.cloudflare.com

File paths

• X:\:`:d:h:l:p:t:x:
• N:\:n:
• P:\:}:
• E:\:o:w:
• X:\:`:d:h:l:p:~:
• K:\:f:n:
• X:\:`:l:p:t:
• X:\:`:d:l:
• X:\:d:l:p:t:x:
• X:\:`:h:p:t:x:
• X:\:d:h:l:p:x:
• X:\:`:d:h:
• S:\:
• X:\:`:d:h:l:p:
• X:\:`:n:
• T:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report