SUSPICIOUS — VoicemodInstaller_1.6.22-w49hb8.exe

SUSPICIOUS — VoicemodInstaller_1.6.22-w49hb8.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100), attributed to the HUILoader family. 1 of 56 detection engines flagged it.

Identification

• SHA-256: a64aae8ca425ae2b2cca1b466338c9352f1eaec0e1087408f40f101c84de226c
• SHA-1: 647d196e2dc318c3b93410ae7381e97b102fa823
• MD5: 818e4a21a7328b462ee4448566325873
• imphash: eb5bc6ff6263b364dfbfb78bdb48ed59
• ssdeep: 98304:K1QTgb/jF2LPpBe5QPHoR8ra8qspnNSgU7nnWNEjeMzkyuuG:2BrUPpUMHoqrf/onW+1M
• TLSH: T14966129EB24AA132C6E7D72062B2BF3E48FBD87B03675404C8D1991FCAD8537616111E
• Submitted as: VoicemodInstaller_1.6.22-w49hb8.exe
• File type: pe · Size: 6396816 bytes
• Verdict: suspicious (54/100) · Family: HUILoader

Detections (1 of 56 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Embedded network infrastructure: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://www.digicert.com/CPS0
• http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline

Embedded domains

• schemas.microsoft.com
• o.in
• vr.ws
• cacerts.digicert.com
• crl3.digicert.com
• www.digicert.com
• crl4.digicert.com
• www.jrsoftware.org

File paths

• H:\6J
• D:\Phd
• U:\kN
• x:\dirname

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report