SUSPICIOUS — f26dbdd26251666ddfb6384aeacafc9be6fbb8dcca4851c2f6fbacf90b98cc1f.bin
SUSPICIOUS — f26dbdd26251666ddfb6384aeacafc9be6fbb8dcca4851c2f6fbacf90b98cc1f.bin is a email sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (55/100), attributed to the AntiVM family. 2 of 54 detection engines flagged it.
Identification
- SHA-256:
f26dbdd26251666ddfb6384aeacafc9be6fbb8dcca4851c2f6fbacf90b98cc1f - SHA-1:
a9904dab01df2ec261a88f71266bc53f72aaed7e - MD5:
e063eb5ff5a4209fcce383def3c01e26 - ssdeep:
49152:TKegAZEc0N5exqklw8GLJgl/vEu1bBJATre3o2KfH9jHBcppd06vkqN4SmwhgvIW:+ - TLSH:
T1E86502452702A282CB90BF70F534F271193274BBBE67298E4D3B28618D974F9D1E0AD5 - Submitted as: f26dbdd26251666ddfb6384aeacafc9be6fbb8dcca4851c2f6fbacf90b98cc1f.bin
- File type: email · Size: 5978824 bytes
- Verdict: suspicious (55/100) · Family: AntiVM
Source: MalShare · first seen 2026-09-11T03:55:29.803Z · SHA-256 verified
Detections (2 of 54 engines)
- YARA: MalwareAnalyser community pack: TL_UPX_Packed
- YARA: Yara-Rules community: YR_AntiVM_Sandbox
Why this verdict
The suspicious score of 55/100 is the fusion of 3 weighted signals:
- YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule
YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70 - YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule
TL_UPX_Packed) - engine signal, weight 0.30, confidence 0.70 - Embedded network infrastructure: 94.100.138.100, 40.107.75.47 - static signal, weight 0.35, confidence 0.60
Embedded domains
- mercure-z8.logifi.fr
- magnesium-z8.logifi.fr
- seli.fr
- hsmx01-hz12.hornetsecurity.com
- mx-gate41-hz12.hornetsecurity.com
- os8pr02cu002.outbound.protection.outlook.com
- hornetsecurity.com
- mail-japanwestazon11012047.outbound.protection.outlook.com
- microsoft.com
- mx.microsoft.com
- parquet.fr
- www.antispameurope.com
Embedded IP addresses
- 10.158.1.69
- 94.100.138.100
- 40.107.75.47
More AntiVM samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report