SUSPICIOUS — dea2d24eee1c12a4919e7b90e21711775b697b9b418347195d5dcb8dac19857a.iso

SUSPICIOUS — dea2d24eee1c12a4919e7b90e21711775b697b9b418347195d5dcb8dac19857a.iso is a unknown sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (53/100), attributed to the Container family. 4 of 53 detection engines flagged it.

Identification

• SHA-256: dea2d24eee1c12a4919e7b90e21711775b697b9b418347195d5dcb8dac19857a
• SHA-1: ecdc2022718079778c2d36bf801a1a5e644c6125
• MD5: ab1d68a3000568efd4c0322a47b08b66
• ssdeep: 393216:rdD4BJwgJfJAQeqKZhSMOZUa+8CGpaahVnTIZRnyxnubo:GLBk1qshIjppVanYnub
• TLSH: T1567133A24EC5142FF276E8E31CBB8C8D8D1F66C37118E0E3275BA1564DF6813896D285
• Submitted as: dea2d24eee1c12a4919e7b90e21711775b697b9b418347195d5dcb8dac19857a.iso
• File type: unknown · Size: 19017728 bytes
• Verdict: suspicious (53/100) · Family: Container

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (4 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
• Microsoft Defender: Trojan:Win32/Ravartar!rfn
• Kaspersky (KVRT): Trojan.Win32.Agent.xcezyc

Why this verdict

The suspicious score of 53/100 is the fusion of 3 weighted signals:

• Embedded executable payload carved at offset 51200 - static signal, weight 0.40, confidence 0.70
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• http://schemas.microsoft.com/SMI/2016/WindowsSettings

Embedded domains

• 9a.pw
• w.za
• i.za
• docs.microsoft.com
• schemas.microsoft.com

File paths

• S:\Kb
• c:\cl
• H:\QeZ
• D:\r
• T:\8
• I:\Fd
• N:\m
• S:\HD
• v:\O;

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report