MALICIOUS — fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll

MALICIOUS — fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (79/100), attributed to the HUILoader family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227
• SHA-1: f0bffa28f4c6e6da60d6fe0d13f805c185148ac2
• MD5: 83bc8de74ba1fd989b9ccda6d04103b8
• imphash: 1f365d4e2c37b47fb208b089b5f61d49
• ssdeep: 24576:17zJjP252w/6rutl+fbfUpTQ2GlQn1dAcFQU2:Flxc+f+U2bDAcaP
• TLSH: T1D95917DE6B173213C77B83145168BA7F08F3EC5A037B695802E68D1ED6F18132A61D1A
• Submitted as: fa4d699db3112a87eea7385944464ccf116709bb5b18921252e869c3604cf227.dll
• File type: pe · Size: 1809920 bytes
• Verdict: malicious (79/100) · Family: HUILoader

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (5 of 55 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Trojan:Win32/Qwexlafiba!rfn
• Emsisoft (Emergency Kit): Gen:Variant.Yogi.3902
• Kaspersky (KVRT): Trojan.Win32.Inject.arjpe

MITRE ATT&CK

• T1547.001
• T1071.001
• T1497
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 79/100 is the fusion of 5 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://api.cloudflare.com/client/v4/zones?per_page=1000
• https://api.cloudflare.com/client/v4/

Embedded domains

• vnd.ahead.space
• vnd.digital
• vnd.net
• vnd.sun.j2me.app
• api.cloudflare.com

File paths

• X:\:`:d:h:l:p:t:x:
• N:\:n:
• P:\:}:
• E:\:o:w:
• X:\:`:d:h:l:p:~:
• K:\:f:n:
• X:\:`:l:p:t:
• X:\:`:d:l:
• X:\:d:l:p:t:x:
• X:\:`:h:p:t:x:
• X:\:d:h:l:p:x:
• X:\:`:d:h:
• S:\:
• X:\:`:d:h:l:p:
• X:\:`:n:
• T:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report