MALICIOUS — c8d147acb659b2163b968654da1d9e0d6c96c6976cc6dbdd0e2ddec3aa5fde7b

MALICIOUS — c8d147acb659b2163b968654da1d9e0d6c96c6976cc6dbdd0e2ddec3aa5fde7b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 4 of 52 detection engines flagged it.

Identification

• SHA-256: c8d147acb659b2163b968654da1d9e0d6c96c6976cc6dbdd0e2ddec3aa5fde7b
• SHA-1: 2913f5c9525c90f9b3eeeafb42fa47d7e264c54b
• MD5: 7fa7654ec410d990776d768f2fc467eb
• imphash: 38aa7c2ff6ef0e48a9520d6702d08df4
• ssdeep: 6144:5vifi4bcyT55K9PhEQdqHIKcUDRXGxKS+bqu:hGRDVMPhEAQIKtRL
• TLSH: T16F429EE1124120BFD2FE8C8D586D8EADD413B0E431B01BEDA18BD94EA438D7394B95D6
• Submitted as: c8d147acb659b2163b968654da1d9e0d6c96c6976cc6dbdd0e2ddec3aa5fde7b
• File type: pe · Size: 213566 bytes
• Verdict: malicious (89/100)

Detections (4 of 52 engines)

• ClamAV (daily): Win.Trojan.Agent-6943819-1
• Microsoft Defender: Virus:Win32/Sivis.A
• Emsisoft (Emergency Kit): Win32.Sivis.A
• Kaspersky (KVRT): Virus.Win32.Agent.es

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Agent-6943819-1 (rule Win.Trojan.Agent-6943819-1) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: http://creativecommons.org/publicdomain/zero/1.0/, http://www.gnu.org/software/coreutils/, http://translationproject.org/team/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://creativecommons.org/publicdomain/zero/1.0/
• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/
• http://www.adobe.com/go/reader_system_reqs.UnmoveFilesFjerner
• http://www.adobe.com/go/reader_system_reqs_no.OLE_VERB_OPEN&
• https://www.digicert.com/CPS0
• http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
• http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
• http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
• http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
• http://www.digicert.com/ssl-cps-repository.htm0
• https://d.symcb.com/rpa0
• http://s.symcb.com/universal-root.crl0
• https://d.symcb.com/rpa0@
• http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
• http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
• http://ardownload.adobe.com/pub/adobe/reader/win/8.x/8.0/misc/WindowsInstaller-KB893803-v2-x86.exe

Embedded domains

• creativecommons.org
• geocities.com
• www.gnu.org
• translationproject.org
• gnu.org
• cygwin.com
• www.adobe.com
• helpx.adobe.com
• www.microsoft.com
• crl3.digicert.com
• crl4.digicert.com
• www.digicert.com
• cacerts.digicert.com
• d.symcb.com
• s.symcb.com
• ts-crl.ws.symantec.com
• ts-aia.ws.symantec.com
• ardownload.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report