MALICIOUS — cf7b1c933da65b3e50a1203a6cc6c78b57006e9e5983fdbc08b3ad3aef2bdb07

MALICIOUS — cf7b1c933da65b3e50a1203a6cc6c78b57006e9e5983fdbc08b3ad3aef2bdb07 is a email sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Bladabindi family. 1 of 54 detection engines flagged it.

Identification

• SHA-256: cf7b1c933da65b3e50a1203a6cc6c78b57006e9e5983fdbc08b3ad3aef2bdb07
• SHA-1: 435d1920b0ca453f3667687207d519408365fb75
• MD5: 0c059f3dea2e34fc4518c5a53eb0d14d
• ssdeep: 12288:rDnvldQjg2LGOi+oIy7ymIewsdd0ALDd:PvldqLGd7y1ewIn1
• TLSH: T13E4923007B9AF2C1850868E169E0FB473C799E867A1A0EF96D27AD55C377A3353643C0
• Submitted as: cf7b1c933da65b3e50a1203a6cc6c78b57006e9e5983fdbc08b3ad3aef2bdb07
• File type: email · Size: 395591 bytes
• Verdict: malicious (91/100) · Family: Bladabindi

Detections (1 of 54 engines)

• ClamAV (daily): Win.Packed.Bladabindi-10017208-0

Why this verdict

The malicious score of 91/100 is the fusion of 3 weighted signals:

• ClamAV (daily) flagged Win.Packed.Bladabindi-10017208-0 (rule Win.Packed.Bladabindi-10017208-0) - engine signal, weight 0.90, confidence 0.95
• Embedded network infrastructure: 159.223.169.44 - static signal, weight 0.35, confidence 0.60
• Suspicious email carrier: archive-attachment - static signal, weight 0.30, confidence 0.70

Embedded domains

• smtp.hhi.co.kr

Embedded IP addresses

• 159.223.169.44

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report