MALICIOUS — 25d1a4c5182425b428e0aa187f83b8549b0e80963859896be428240ce627f860

MALICIOUS — 25d1a4c5182425b428e0aa187f83b8549b0e80963859896be428240ce627f860 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (94/100), attributed to the Fileinfector family. 6 of 52 detection engines flagged it.

Identification

• SHA-256: 25d1a4c5182425b428e0aa187f83b8549b0e80963859896be428240ce627f860
• SHA-1: b9e0e6bb9389fa999d27fe582deba6d09b9a6297
• MD5: 0252b8baf72e57a634b6f6a69844c63f
• imphash: 895fbb56c02c3d2bca3125cef5da8730
• File type: pe · Size: 1435774 bytes
• Verdict: malicious (94/100) · Family: Fileinfector

Detections (6 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Fileinfector-9832954-0
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:UPX 3.96
• Kaspersky (KVRT): Virus.Win32.Lamer.ks
• Microsoft Defender: Trojan:Win32/Vindor!pz

Embedded URLs

• http://crl.microsoft.com/pkiinfra/CRL/AME%20CS%20CA%2001
• http://crl2.ame.gbl/crl/ameroot.crl
• http://crl3.ame.gbl/crl/ameroot.crl
• http://crl1.ame.gbl/crl/ameroot.crl
• http://crl.microsoft.com/pkiinfra/certs/AMERoot_ameroot.crt07
• http://crl2.ame.gbl/aia/AMERoot_ameroot.crt07
• http://crl3.ame.gbl/aia/AMERoot_ameroot.crt07
• http://crl1.ame.gbl/aia/AMERoot_ameroot.crt0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0

Embedded domains

• crl.microsoft.com
• www.microsoft.com
• crl2.ame.gbl
• crl3.ame.gbl
• crl1.ame.gbl

File paths

• C:\__w\1\Vulkan-Loader\build\loader\RelWithDebInfo\vulkan-1.pdb
• B:\:

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report