MALICIOUS — d44fe259c48cfd0061f255537cfe8ea8a2bd10f9ce4437e167abdb64c09af561

MALICIOUS — d44fe259c48cfd0061f255537cfe8ea8a2bd10f9ce4437e167abdb64c09af561 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Vobfus family. 4 of 55 detection engines flagged it.

Identification

SHA-256: d44fe259c48cfd0061f255537cfe8ea8a2bd10f9ce4437e167abdb64c09af561
SHA-1: a9b55e187f48e040e3ef2f34e5ec0848aef46c9f
MD5: 4f09d974398bb03c7ac0bd51f341ddd6
imphash: 8262fdc48a399d7b8190a3af463a61f7
ssdeep: 3072:FN2NSItEiROnFNjWmPjCXMN5iH1VMZZZZWMkIJih:qp4jWmEMN+1VHYe
TLSH: T114410595FEDDE6B4D166E20749411C6C768EE75EFEAA533113BA4A1E04D23E3202072C
Submitted as: d44fe259c48cfd0061f255537cfe8ea8a2bd10f9ce4437e167abdb64c09af561
File type: pe · Size: 184320 bytes
Verdict: malicious (89/100) · Family: Vobfus

Detections (4 of 55 engines)

ClamAV (daily): Win.Trojan.Vobfus-45
Microsoft Defender: Worm:Win32/Vobfus.FI
Trellix Stinger (McAfee): VBObfus.ei
Kaspersky (KVRT): Trojan.Win32.Vobfus.llu

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

ClamAV (daily) flagged Win.Trojan.Vobfus-45 (rule Win.Trojan.Vobfus-45) - engine signal, weight 0.90, confidence 0.95
Embedded network infrastructure: http://vbnet.mvps.org/index.html, http://www.Planet-Source-Code.com/vb/, http://vb.mvps.org/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

http://vbnet.mvps.org/index.html
http://www.Planet-Source-Code.com/vb/
http://vb.mvps.org/
http://allapi.mentalis.org/apilist/apilist.php

Embedded domains

vbnet.mvps.org
vb.mvps.org
allapi.mentalis.org
www.planet-source-code.com

File paths

C:\Windows\system32\msvbvm60.dll\3
C:\Program

More Vobfus samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report