MALICIOUS — ahefi-unpacked-stage.exe

MALICIOUS — ahefi-unpacked-stage.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (84/100), attributed to the HUILoader family. 3 of 55 detection engines flagged it.

Identification

• SHA-256: eaad1cb68a8f1717ae2892c08c46c5f4305aa357a97116026bb31c1c781726d6
• SHA-1: 37feac45cd555645977ff9310c4a6a8d649c8d6e
• MD5: 67fc48a6b2d99b251e9b2b8fc7b7172e
• imphash: 694a10f92efdb5ba9c32ad08fff67a41
• ssdeep: 6144:d+5o8WoBDH5pguKEAJPvikOnpLHF6sxXw45WJc2y1VwFmDehJDVuiS7om4IVZs/:dnoBbvgp9si1m4IVZsrjBXNCDvYo
• TLSH: T17D4DA63246953B09D6926D04702A61DE07B9B4E3A3B0EC88D35FE1122CE354F29D5EF6
• Submitted as: ahefi-unpacked-stage.exe
• File type: pe · Size: 614912 bytes
• Verdict: malicious (84/100) · Family: HUILoader

Detections (3 of 55 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Emsisoft (Emergency Kit): Gen:Variant.Midie.189383
• Kaspersky (KVRT): HackTool.Win64.Knotweed.cku

Why this verdict

The malicious score of 84/100 is the fusion of 3 weighted signals:

• Emsisoft (Emergency Kit) flagged Gen:Variant.Midie.189383 (rule Gen:Variant.Midie.189383) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HackTool.Win64.Knotweed.cku (rule HackTool.Win64.Knotweed.cku) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report