MALICIOUS — cf84c71583e6bf3bf454bf4a33b8c78d888baab0088ccee6dc2bf023b3910a4a

MALICIOUS — cf84c71583e6bf3bf454bf4a33b8c78d888baab0088ccee6dc2bf023b3910a4a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Unruy family. 5 of 52 detection engines flagged it.

Identification

• SHA-256: cf84c71583e6bf3bf454bf4a33b8c78d888baab0088ccee6dc2bf023b3910a4a
• SHA-1: d9a4e36c03750fb4566a8e8a33eb8e8100406612
• MD5: 9179122d4609f37840e630bf966ae3d9
• imphash: 799648032be17bf6d9bce0159e2ededa
• ssdeep: 6144:sm5UsluzKOj1MuAyE+7YnnIj/FO922H35+hV0PlkD4KLjF0JEZHuO3bvvxthFpCW:smqslOKoDpUSNFuObLt
• TLSH: T16A49B0221A0ABA74D73F3F396829E70F7A138D3FA1EC212612514B1A7D1915FD3D1229
• Submitted as: cf84c71583e6bf3bf454bf4a33b8c78d888baab0088ccee6dc2bf023b3910a4a
• File type: pe · Size: 398668 bytes
• Verdict: malicious (89/100) · Family: Unruy

Detections (5 of 52 engines)

• ClamAV (daily): Win.Downloader.Unruy-6988793-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
• Emsisoft (Emergency Kit): Gen:Variant.Barys.458891
• Kaspersky (KVRT): Trojan-Clicker.Win32.Cycler.amiy

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Downloader.Unruy-6988793-0 (rule Win.Downloader.Unruy-6988793-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Unruy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report