MALICIOUS — a4f34cc0f4ba51ee1a8b2f3197a57c683871997a6ac7c78987e84980c4953323

MALICIOUS — a4f34cc0f4ba51ee1a8b2f3197a57c683871997a6ac7c78987e84980c4953323 is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: a4f34cc0f4ba51ee1a8b2f3197a57c683871997a6ac7c78987e84980c4953323
• SHA-1: 6b2b6fea7e432d3d7d6ee9fbef630e2757e9f99e
• MD5: 6ea806358a199a860f82e21185781aaf
• ssdeep: 6144:GFg3Ow4/Wu4m015OP2f0rKhshI9HrCLP/0Nz3D/whCETuVQ9GaJlpPMMDp7ijkBj:GFge5/WD16mshYHrCL301T/whCETRN
• TLSH: T1A75769CBFA662C44A8D1A444DE5602EC00195339E430DBF6DDC2C2895F6AE9ED2EDD1C
• Submitted as: a4f34cc0f4ba51ee1a8b2f3197a57c683871997a6ac7c78987e84980c4953323
• File type: macho · Size: 1544136 bytes
• Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

• ClamAV (daily): Osx.Adware.Adload-9890129-1
• Microsoft Defender: Adware:MacOS/Adload.D!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
• Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report