CLEAN — db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d.zip

CLEAN — db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (25/100). 4 of 54 detection engines flagged it.

Identification

• SHA-256: db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d
• SHA-1: f05369f1fce6a5a049036e66e27292c163ac15d0
• MD5: 2554316da2f58f58842e658619a40a61
• ssdeep: 49152:JnQ9qVFhBu5NAr5z0xvI9Q5tvz0qWcQeXdY7TZ4E1GW4aLksf/dsIvid4/T4Ur4D:Jn24hsHsqRZ7b0qm4dY/Z4C4E/id4LLI
• TLSH: T18F5E33C69FFD4508E0C0FA09B9F3185FFAD9E914993158B4EF85A0608AE0B87C5518B7
• Submitted as: db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d.zip
• File type: zip · Size: 3131448 bytes
• Verdict: clean (25/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (4 of 54 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• Microsoft Defender: Trojan:Win32/Suschil!rfn
• Emsisoft (Emergency Kit): Adware.GenericKD.61157421
• Kaspersky (KVRT): Trojan.BAT.Agent.gjc

Why this verdict

The clean score of 25/100 is the fusion of 2 weighted signals:

• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
• Archive contains executables: bin/cygwin1.dll, bin/WinDivert.dll, bin/winws.exe, general (ALT).bat, general (ALT10).bat - static signal, weight 0.25, confidence 0.50

Archive contents (15 executables)

This zip carries 15 extracted members, each analyzed as its own sample (listing truncated):

• WinDivert.dll - c1e060ee19444a259b2162f8af0f3fe8c4428a1c6f694dce20de194ac8d7d9a2
• WinDivert64.sys - 8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2
• cygwin1.dll - 103104a52e5293ce418944725df19e2bf81ad9269b9a120d71d39028e821499b
• winws.exe - affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
• general (ALT).bat - d6ff1fd1ed7c4be6430f43264dfebf4edc87de772806e13cad04306164b2270f
• general (ALT10).bat - 5dccd9fdc3700bb2f7eba770621ce4b19bfeb45bf599c9d6cc3bc81e70cadfff
• general (ALT11).bat - 58bd9e2d1b3b82bc0b1780171dfa40c386bf9032bae397461e81ca440bada45c
• general (ALT12).bat - 23c48c1c16712ef1fd3bdce33218fc6adf03da96c3195fc9d14d6d233b1ab44c
• general (ALT2).bat - 7ccd02179060f5517a6759d990cfdd5f4545439accbbe9dd91f824fecb73e07d
• general (ALT3).bat - 35c443fc2566dc71787a9a576526280bd0f890983af419d0ca9fe13d1d2c704b
• general (ALT4).bat - 426c23f1e83e56f27de637a13cc26cb07914d097fe4fcc5b08afbbbb19fe82cf
• general (ALT5).bat - d0a0815d38c60aed709adc731f494585cde3257aa8801602f4861a5ac2527308
• general (ALT6).bat - e77d5173a69f47e9fa9d4fbd760461b478814985835984286fff792d76a0c069
• general (ALT7).bat - 67afb46783e24f6312e7e753253d59885a67352d80c113bb338d27f0470428b7
• general (ALT8).bat - 0e1948be5dae585688f848f456d30d3a8d4c3572f10eb4f46912062effb348b7

Dynamic analysis

This zip is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.

Embedded domains

• 4pda.to
• www.onetrust.com
• www.google.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report