MALICIOUS — readme.eml

MALICIOUS — readme.eml is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Nimda family. 8 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: c4a60096ad81f6e4ce7412f4873465de408eab69d7ac35b9af9b0b1a4ccd3eea
• SHA-1: 1c944d94b906a5212d72a4462d18e853f490c245
• MD5: 7a9527afdda4179b10e5465e93d0f3aa
• imphash: f7c5cb7d3be0b2cc0b9c48f91b1670b7
• ssdeep: 768:G25LUnfdfZGc9o/E01Uofr/e/I4AUJJ4x+LmXMUtcQOv/aXOpYp:afZGc90C0eRfpLOMzvb
• TLSH: T144343A004451DAC6D7D07252FD518D0C7DF6A8FA52BACC84A6DEE23E4BE806BD08B572
• Submitted as: readme.eml
• File type: pe · Size: 57344 bytes
• Verdict: malicious (100/100) · Family: Nimda

Detections (8 of 52 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• ClamAV (daily): {HEX}bin.trojan.generic.n.93.UNOFFICIAL
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Microsoft Defender: Virus:Win32/Nimda.H@mm
• Emsisoft (Emergency Kit): Win32.Worm.Nimda.U
• Trellix Stinger (McAfee): W32/Nimda@MM
• Kaspersky (KVRT): Net-Worm.Win32.Nimda

MITRE ATT&CK

• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 8 weighted signals:

• ClamAV (daily) flagged {HEX}bin.trojan.generic.n.93.UNOFFICIAL (rule {HEX}bin.trojan.generic.n.93.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• Microsoft Defender flagged Virus:Win32/Nimda.H@mm (rule Virus:Win32/Nimda.H@mm) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Worm.Nimda.U (rule Win32.Worm.Nimda.U) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged W32/Nimda@MM (rule W32/Nimda@MM) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

File paths

• c:\Admin.dll
• d:\Admin.dll
• e:\Admin.dll
• W:\:d:i:o:v:{:

More Nimda samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report