MALICIOUS — b9d647bfa6a67364f3b0314999be9e60406569be4cdd1f0f7a0b838e45acede1.bin

MALICIOUS — b9d647bfa6a67364f3b0314999be9e60406569be4cdd1f0f7a0b838e45acede1.bin is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the ObfLoader family. 4 of 50 detection engines flagged it.

Identification

• SHA-256: b9d647bfa6a67364f3b0314999be9e60406569be4cdd1f0f7a0b838e45acede1
• SHA-1: 79618e1636aeee265526885e50e20370dd69d0f1
• MD5: 0d61f9134f38091ac044866f314eee35
• ssdeep: 98304:0CnZa3j3Hwo8GIiA2QXHj6pW+YQn/5xHOzGt0Wmfvh7BfzBn2ooDWg:3ZGj3w3Gi2QuRDuHrnPk9
• TLSH: T1975F6CF04A4B77EEE9CE440047E8FA3A953CF6A93573D432052673B81A4E2D4A4315AD
• Submitted as: b9d647bfa6a67364f3b0314999be9e60406569be4cdd1f0f7a0b838e45acede1.bin
• File type: unknown · Size: 3362575 bytes
• Verdict: malicious (99/100) · Family: ObfLoader

Source: MalShare · first seen 2026-08-04T15:11:56.666Z · SHA-256 verified

Detections (4 of 50 engines)

• ClamAV feed: SaneSecurity foxhole_generic: Sanesecurity.Rogue.0hr.20260804-1432.UNOFFICIAL
• Hash: abuse.ch ThreatFox: known-malicious-hash
• Emsisoft (Emergency Kit): GT:JS.ObfLoader.3.9FDF4A7D
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The malicious score of 99/100 is the fusion of 3 weighted signals:

• ClamAV feed: SaneSecurity foxhole_generic flagged Sanesecurity.Rogue.0hr.20260804-1432.UNOFFICIAL (rule Sanesecurity.Rogue.0hr.20260804-1432.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Emsisoft (Emergency Kit) flagged GT:JS.ObfLoader.3.9FDF4A7D (rule GT:JS.ObfLoader.3.9FDF4A7D) - engine signal, weight 0.55, confidence 0.85

More ObfLoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report