MALICIOUS — c483e494c965c84e0b0886cfae32607fe839f0abb731005664ddd8c6b8b4f1db
MALICIOUS — c483e494c965c84e0b0886cfae32607fe839f0abb731005664ddd8c6b8b4f1db is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (86/100), attributed to the Shellcode family. 8 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c483e494c965c84e0b0886cfae32607fe839f0abb731005664ddd8c6b8b4f1db - SHA-1:
9fd7c5ef724952f941e5996bda482f6723b65176 - MD5:
a00a4c3c3bddee30608932639943bf70 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
6144:IifgAxlO0MBTUYDMX6n212L6Wlvc2v5r6AX2Vq4SooVSr8vOk9aOWZZz9bqRu0o:fRnrKfpnO3o7huAB9VSBZQRu0z8ke - TLSH:
T1B04BCD90804C0652F3779A3C57D39D5DD0C0E7EB966626CF0276F17920A1A1BCEEAE12 - Submitted as: c483e494c965c84e0b0886cfae32607fe839f0abb731005664ddd8c6b8b4f1db
- File type: pe · Size: 507904 bytes
- Verdict: malicious (86/100) · Family: Shellcode
Detections (8 of 52 engines)
- YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:MSIL/Remcos.AAR!MTB
- Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.21533
- Kaspersky (KVRT): HEUR:Trojan.MSIL.Injector.gen
MITRE ATT&CK
YARA
- Windows_Injection_Api_Combo
Why this verdict
The malicious score of 86/100 is the fusion of 5 weighted signals:
- Process injection API combination (rule
Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule
TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
File paths
- E:\Projects\05.06\COM
More Shellcode samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report