MALICIOUS — 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1

MALICIOUS — 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the NabucurObfs family. 5 of 25 detection engines flagged it.

Identification

• SHA-256: 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1
• SHA-1: 0bb4e5e8c64fbab5a197005bc288ec7e3c1d3e2d
• MD5: c969ce420e1a08fba0abd41e7472dd2c
• imphash: d41d8cd98f00b204e9800998ecf8427e
• ssdeep: 24576:NBCnbIgIxxdxyTV2Zq3RyiVyjNMqn75CujZR:NQnbIgIb7Q2Z6yNNMYocL
• TLSH: T17C58457A2B79F5D5892798D06D14E75A3F46B72029730CF0D2BAA3C1A4078381E4DE9C
• Submitted as: 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1
• File type: pe · Size: 1767424 bytes
• Verdict: malicious (93/100) · Family: NabucurObfs

Detections (5 of 25 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• Microsoft Defender: Trojan:Win32/NabucurObfs
• Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
• Trellix Stinger (McAfee): W32/VirRansom
• Kaspersky (KVRT): Virus.Win32.PolyRansom.a

Why this verdict

The malicious score of 93/100 is the fusion of 5 weighted signals:

• Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report