MALICIOUS — cdecede66fdbf9a7453fb4b3fdb8c2e681fe5e859619b43355f7b53a48453921

MALICIOUS — cdecede66fdbf9a7453fb4b3fdb8c2e681fe5e859619b43355f7b53a48453921 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Wecod family. 8 of 52 detection engines flagged it.

Identification

• SHA-256: cdecede66fdbf9a7453fb4b3fdb8c2e681fe5e859619b43355f7b53a48453921
• SHA-1: f6fd15594d2920035f6a14f0a21c420f69fce4e0
• MD5: 9b7ec8f73239c791ac9e451274dd3ea8
• imphash: 771a115c71e9bfdbb358577bef0aa4d4
• ssdeep: 6144:OsCXeLETucMkh1hjMoSp0T5J5ZtmOywI:DBcMSMoSq/ot
• TLSH: T13343DF4CC5F227C9CBE753395F68846E68E10DE9C43F8C612982E03057E2A67C5E249B
• Submitted as: cdecede66fdbf9a7453fb4b3fdb8c2e681fe5e859619b43355f7b53a48453921
• File type: pe · Size: 219798 bytes
• Verdict: malicious (93/100) · Family: Wecod

Detections (8 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Packed.Wecod-9888271-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win32/Vindor!pz
• Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
• Trellix Stinger (McAfee): Corrupt-JK!9B7EC8F73239
• Kaspersky (KVRT): Trojan.Win32.Wecod.alk

Why this verdict

The malicious score of 93/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Win.Packed.Wecod-9888271-0 (rule Win.Packed.Wecod-9888271-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Wecod samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report