MALICIOUS — 3939dad4a49f5970d464bbcd629955c5501354533e1a137466773dd9aeabdd0e

MALICIOUS — 3939dad4a49f5970d464bbcd629955c5501354533e1a137466773dd9aeabdd0e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Fileinfector family. 8 of 52 detection engines flagged it.

Identification

• SHA-256: 3939dad4a49f5970d464bbcd629955c5501354533e1a137466773dd9aeabdd0e
• SHA-1: 657967698b0362bd302327607108ea73f1ced74f
• MD5: 65a6f9669ee6865b01fb48fd7a96055c
• imphash: 895fbb56c02c3d2bca3125cef5da8730
• File type: pe · Size: 3468055 bytes
• Verdict: malicious (96/100) · Family: Fileinfector

Detections (8 of 52 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• ClamAV (daily): Win.Malware.Fileinfector-9832954-0
• YARA: JPCERT/CC: JPCERT_Emotet
• YARA: Trellix/McAfee ATR: ATR_Conti_Ransomware
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Detect It Easy (packer/type): DIE:UPX 3.96
• Microsoft Defender: Trojan:Win32/Vindor!pz
• Kaspersky (KVRT): Virus.Win32.Lamer.ks

Embedded URLs

• http://schemas.microsoft.com/windows/2014/11/printing/generatedkeywords
• http://schemas.microsoft.com/windows/2013/05/printing/printschemakeywordsv11
• http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywords
• http://www.w3.org/2001/XMLSchema
• http://www.w3.org/2001/XMLSchema-instance
• http://schemas.microsoft.com/2002/print/gdl/1.0
• http://schemas.microsoft.com/windows/2003/08/printing/printschemakeywordsW

Embedded domains

• schemas.microsoft.com
• www.w3.org

File paths

• X:\:`:d:h:l:p:t:x:
• X:\:l:p:
• T:\:d:l:t:
• L:\:`:d:x:
• X:\:d:h:p:t:
• X:\:`:d:h:l:t:
• T:\:d:h:l:t:x:
• X:\:l:p:t:x:
• X:\:`:d:l:p:t:x:
• X:\:`:d:h:l:p:x:
• X:\:h:l:p:t:x:
• V:\:b:h:l:
• B:\:h:
• L:\:h:p:
• T:\:d:l:x:
• T:\:d:l:
• L:\:l:

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report