MALICIOUS — d42318d0d3feaf209ef8c071dba2c4a4a5b5b93324f8c39cb24d25cfeb74682c

MALICIOUS — d42318d0d3feaf209ef8c071dba2c4a4a5b5b93324f8c39cb24d25cfeb74682c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (82/100), attributed to the Rahiwi family. 5 of 25 detection engines flagged it.

Identification

SHA-256: d42318d0d3feaf209ef8c071dba2c4a4a5b5b93324f8c39cb24d25cfeb74682c
SHA-1: 196014f3226396374131a8e0af0dee77cba63bbf
MD5: 59d1f213274081f4caebf623ecfcfc0e
imphash: 1b675db9a912fecbf83526e2fd37cf23
ssdeep: 6144:2WC4YgB9Giy6WC4YgB9Giy8mWC4YgB9GiygWC4YgB9GiyMWC4YgB9Giy8mWC4Ygg:FtJ9Gi8tJ9Gi7VtJ9GiatJ9GiKtJ9GiI
TLSH: T15D45E1C3653A3616DED7B4FA2084150F67A9C4801C7BECD44E6B81187B2872B68FD867
Submitted as: d42318d0d3feaf209ef8c071dba2c4a4a5b5b93324f8c39cb24d25cfeb74682c
File type: pe · Size: 281421 bytes
Verdict: malicious (82/100) · Family: Rahiwi

Detections (5 of 25 engines)

MalwareAnalyser heuristics (entropy/packer): Petite
Detect It Easy (packer/type): DIE:Petite 2.2
Microsoft Defender: Worm:Win32/Rahiwi!pz
Emsisoft (Emergency Kit): Gen:Variant.Worm.VB.75
Kaspersky (KVRT): Email-Worm.Win32.Brontok.am

Why this verdict

The malicious score of 82/100 is the fusion of 4 weighted signals:

Microsoft Defender flagged Worm:Win32/Rahiwi!pz (rule Worm:Win32/Rahiwi!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Worm.VB.75 (rule Gen:Variant.Worm.VB.75) - engine signal, weight 0.55, confidence 0.85
Detect It Easy (packer/type) flagged DIE:Petite 2.2 (rule DIE:Petite 2.2) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Petite, high-entropy-sections:.petite, Petite 2.2 - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More Rahiwi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report