MALICIOUS — b47f017a19801ab289270980a6acfc5dafdce8841eb627a45be5553828d32b94

MALICIOUS — b47f017a19801ab289270980a6acfc5dafdce8841eb627a45be5553828d32b94 is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

SHA-256: b47f017a19801ab289270980a6acfc5dafdce8841eb627a45be5553828d32b94
SHA-1: 3b2a16d770eb0df75c4738872bc27aec5aa016f9
MD5: 45537ff5bdbc7da5b39b932896465a8d
ssdeep: 12288:3TZ2JUN0l7XdR1UqpsCU3Vr4keiiEVco:3Tw2N0l7d0qpsCU354kUST
TLSH: T1575768CBFA662C44A8D1A444DE5602EC00195339E830DBF6DDC2C2895F6AE9DD2EDD1C
Submitted as: b47f017a19801ab289270980a6acfc5dafdce8841eb627a45be5553828d32b94
File type: macho · Size: 1572808 bytes
Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

ClamAV (daily): Osx.Adware.Adload-9890129-1
Microsoft Defender: Adware:MacOS/Adload.D!MTB
Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report